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Readers Data Exchange 

New COMPUTIST readers using Apple 
lis are advised to read this page carnally to 
avoidfrustration when attempting to follow 
a softkey or entering the programs printed 
in this issue. 



What is a softkey, anyway? 

Softkey is a term which we coined to describe 
aprocedurethatremoves, or atleastcircumvents, 
any copy-protection on a particular disk. Once a 
softkey procedure has been performed, the re- 
sulting backup copy can usually be copied by the 
normal copy programs (for example: COPYA, 
on the DOS 3.3 System Master disk). 

Commands and control keys 

Commands which a reader is required to 
perform are set apart by being in boldface and on 
a separate line. The return key must be pressed 
at the end of every such command unless other- 
wise specified. Control characters are preceeded 
by "Ctrl". An example of both is: 
6 Ctrl P 

Type 6. Next, place one finger on the Ctrl key 
and then press P. Don' t forget to press the return 
key. 

Other special combination keypresses include 
Ctrl reset and open-apple Ctrl reset. In the for- 
mer, press and hold dovm the Ctrl key then press 
the reset key. In the latter, press and hold down 
both Ctrl and open-apple then press reset . 



Software recommendations 

The Starter Kit contains most of the programs 
that you need to "Get started". In addition, we 
recommend that you acquire the following: 

• Applesoft program editor such as "Global 
Program Line Editor (GPLE)". 

•Assembler such as "Merlin/Big Mac". 

•Bit-copy program such as "Copy II Plus", 
"Locksmith" or "Essential Data Duplicator". 

•Word-processor (such as AppleWorks). 

•"COPYA", "HD" and "MUPHN" from the 
DOS 3.3 System Master disk. 

Super lOB and Controllers 

This powerful deprotection utility (in the 
COMPUTIST Starter Kit) and its various Con- 
trollers are used in many softkeys. (It is also on 
each Super lOB Collection disk.) 

Reset into the Monitor 

Softkeys occasionally require the user to stop 
the execution of a copy-protected program and 
directly enter the Apple' s system monitor. Check 
the following list to see what hardware you will 
need to obtain this ability. 

Laser 128: Your ROM includes a forced jump 
to the monitor. Press Ctrl return reset. 

Apple II+, //e, compatibles: 1) Place an Inte- 
ger BASIC ROM card in one of the Apple slots. 
2) Use a non-maskable interrupt (NMI) card such 
as Replay or Wildcard. 

Apple n+, compatibles: 1 )Install anF8 ROM 
with a modified reset-vector on the computer's 
motherboard as detailed in the "ModifiedROM's" 
article(COMPUTIST#6orBookOfSoftkeysm 
) or the "Dual ROM's" article (COMPUTIST 
#19). 

Apple lie. He: Install a modified CD ROM on 
the computer's motherboard that changes the 
open-apple Ctrl reset vector to point to the moni- 
tor. (This will void an Apple He warranty since 
you must open the case to install it.) 

Apple //gs: If you have the 2.x ROM, there is 
a hidden Classic Desk Accessory (CDA) that 
allows you to enter the monitor. In order to install 
the new CDA, you should enter the monitor 
(CALL -151) before running any protected pro- 
grams and press # return . This will turn on two 
hidden CDAs, Memory Peeker and Visit Moni- 
tor. Thereafter press operiapple ctrl esc to go to 
the Desk Accessories menu. Select Visit Monitor 
and there you are. Use Ctrl Y to exit. 

Recommended literature 

•Apple n Reference Manual (or lie, lie, etc.) 

•DOS 3.3 & ProDOS manual 

•Beneath Apple DOS & Beneath Apple Pro- 
DOS, by Don Worth and Pieter Lechner, jirom 
Quality Software 

Typing Applesoft programs 

BASIC programs are printed in a format that 
is designed to minimize errors for readers who 
key in these programs. If you type: 

10HOME:REMCLEAR SCREEN 

The UST will look like: 

10 HOME : REM CLEAR SCREEN 

Applesoft inserts spaces into a program list- 
ing before and after every command word or 
mathematical operator. These spaces don't pose 
a problem except when they are inside of quotes 
or after a DATA cortunand. There are two types 
of spiaces: those that have to be keyed and those 
that don't. Spaces that must be typed appear in 
COMPUTIST as special characters (0). All other 
spaces are there for easier reading. 

NOTE: If you wantyour checksums to match, 
only type spaces within quotes or after DATA 
statements if they are shown as (0) charactors. 
SAVE the program atperiodic intervals using the 
name given in the article. All characters after a 
REM are not checked by the checksum program 
so typing them is optional. 

Typing Hexdumps 

Machine language programs are printed in 
COMPUTIST as hexdumps, sometimes also as 
source code. 

Hexdumps are the shortest and easiest format 
to type in. You must first enter the monitor: 
CALL -151 

Key in the hexdump exactly as it appears in 
the magazine, ignoring the four-digit checksum 
($ and four digits) at the end of each line. When 
finished, return to BASIC with: 
3D0G 

BSAVE the program with the filename, ad- 
dress and length parameters given in the article. 

Typing Source Code 

The source code is printed to help explain a 
program's operation. To enter it, you need an 



"Assembler". Most of the source code in older 
issues is in S-C Assembler format. If you use a 
different assembler, you will have to translate 
portions of the source code into something your 
assembler will understand. 

Computing checksums 

Checksums are 4-digit hexadecimal numbers 
which tell if you typed a program correctly and 
help you locate any errors. There are two types of 
checksums: one created by the CHECKB IN pro- 
gram (for machine language programs) and the 
other created by the CHECKSOFT program (for 
BASIC programs). Both are on the "Starter Kit". 

If your checksums do not match the published 
checksums then the line where the first checksum 
differs is incorrect. 

CHECKSOFT instructions: Install Checksoft 
(BRUN CHECKSOFT) then LOAD your pro- 
gram. Press & to get the checksums. Correct the 
program line where the checksums first differ. 

CHECKBIN instructions: Enter the monitor 
(CALL -151), install Checkbin at some out of the 
way place (BRUN CHECKBIN, AS6000), and 
then LOAD your program. Get the checksums by 
typing the Starting address, a jjeriod and the 
Ending address of the file followed by a Ctrl Y . 
SSSS.EEEEctrlY 

Correct the lines where the checksums differ. 

Writing to the RDEX editor 

RDEX (are-decks) stands for: Reader's Data 
Exchange. We print what you write. When you 
send in articles, softkeys, APTs, etc., you are 
submitting them for free publication in this 
magazine. RDEX does nof purchase submissions 
nordoweverifydatasubmittedbyreaders.Ifyou 
discover any errors, please let us know so that we 
may inform our other readers. 

Remember that your letters or parts of them 
may be used in RDEX even if not addressed to the 
RDEX editor. Correspondence that gets pub- 
lished may be edited for clarity, grammar and 
space requirements. 

Because of the great number of letters we 
receive and the ephemeral and unpredictable 
appearance of our volunteer staff, any response 
to your queries will appear only in RDEX, so it 
would be more appropriate for you to present 
technical questions to the readers and ask for 
their responses which will then be placed in the 
Apple-RDEX. 

How to get a free library disk 

Whenever possible, send everything on Ap- 
ple format (5.25" - DOS/ProDOS or 3.5" - Pro- 
DOS) or IBM format (3.5") disks. Other formats 
are acceptable but there may be some delay as we 
look for someone to translate it for us. (If you use 
a 5.25" disk, when we print your letter, we will 
return your disk with the current library disk 
copied onto it.) Use whatever text editor you like, 
but tell us which one. Put a label on the disk with 
your name (or pseudonym) and address (if you 
want to receive mail). Don't reformat any pro- 
grams or include them in the text of your letter. 



Send Applesoft programs as normal Ai>plesoft 
files and machine language programs as normal 
binary files. We have programs to convert them 
to the proper format for printing. If you are 
sending source code files, and you are not using 
the S-C Assembler, send them as normal text 
files. 

When to include a printed letter 

Don't include hardcopy (printout) unless: 

a. You are writing about a bug or other printing 

error. 

b. You are writing to ask for help. 

c. You are answering another readers help re- 
quest. 

d. You are writing about your subscription or 
sending an order for back issues or software. 

Bugs, requests for help and answers to re- 
quests for help are bumped to the head of the line 
and go in the very next issue. All other letters are 
printed in the order that we receive them. 

Writing to get help 

When writing to request help, be sure to 
include ALL relevent information. The more 
information you include, the easier it is to find a 
solution. There's an old saying that goes "A 
properly framed question includes 90% of the 
answer". 

How to get mail 

If you are interested in receiving mail from 
other readers, be sure that we have a current 
address. If you use a pen name and want to 
receive mail, we need to have your address. Our 
readers privacy is important, so we will not print 
your address unless you specifically say too. 

How to write to RDEX authors 

When writing to one of the RDEX authors. 
Write your letter and seal it in an envelope. I'ut 
your return address, the authors name (as it 
appeats in RDEX) and the correct postage on the 
envelope. Put this envelope into another and send 
it to RDEX. We will put the correct address on 
your letter and mail it for you. Check to the right 
of the authors name to see if the author is writing 
from a foreign coimtry and include the i)rop)er 
postage. 

Help Line 

These readers have volunteered their time to 
help you. Please call only within the given time 
frames (conected for your time zone). No collect 
calls. 

Jack Nissel (Disk Protection, 7- 10PM EST) 
(215)365-8160 

The BBS (Bulletin Board System) 

Dave Goforth is the sysop for the Computist 
BBS. The number is: (206) 581-9292. If you 
already have a User ID# and password, sign-on 
using the User ID#. If you are a new user, it may 
take a day or so to validate your new ID# and 
password. 



You have a LEGAL RIGHT 

to an unlocked backup copy 

of your commercial software. 



Our editorial policy is that we do NOT condone software piracy, but we do believe that users 
are entitled to backup commercial disks they have purchased. 

In addition to the security of a backup disk, the removal of copy-protection gives the user the 
option of modifying programs to meet his or her needs. 

Furthermore, the copyright laws guarantee your right to such a DEPROTECTED backup 
copy: 

.. ."It is not an infringement for the owner of a copy of a computer j)rogram to make or authorize 
the making of another copy or adaptation of that computer program provided: 

1 ) that such a new copjy or adaptation is created as an essential step in the utilization of the computer 
program in conjunction with a machine and that it is used in no other maimer, or 

2) that such new copy or adaptation is for archival purposes only and that all archival copies are 
destroyed in the event that continued possession of the computer program should cease to be 
rightful. 

Any exact copies prepared in accordance with the provisions of this section may be leased, sold, 
or otherwise transferred, along with the copy from which such copies were prepared, only as part 
of the lease, sale, or other transfer of all rights in the program. Adaptations so prepared may be 
transferred only with the authorization of tfie copyright owner." 



United States Code title 17, §117 
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Advanced Playing Technique for... 
Warlock GS 

Three Sixty 

Here is a revision to the Warlock APT in 
issue #73 by Don Westcott. I tried to use 
Don's APT, but the bytes were not at the 
right locations on my version. So I whipped 
out the old trusty Copy 11+ and scanned for 
bytes ED 23 01 8D as Don had on his APT. 
When the search didn ' t find them, I thought, 
it's a ProDOS 16 program, why not look for 
it with relocatable code. Sure enough, when 
I scanned for bytes ED 00 00 8D it showed 
up 3 times. Once I changed the bytes it 
worked! So here goes, make these edits (on 
a backup disk of course.) 

fi!k Bytg From l2 

$240 $1D1 ED00008D ADOOOOAD 

$241 $068 ED00008D ADOOOOAD 

$0C6 ED00008D ADOOOOAD 

Just goes to show, that you should send 
all information you can on APTs or softkeys. 
Thanks again to Don for this APT. 

To Rob Fiduccia: On his question in 
issue 73 about searching memory with the 
monitor on the Ilgs (best thing around to do 
APTs with). Here goes: 
\ bytes \< start addr . end addr P 

This will allow you to search an address 
range for a sequence of bytes. For example: 
to search for bytes 00 67 B 1 at address range 
$0000 to $FFFF you would type (while in 
the monitor): 

\00 67 B1\<0000.FFFFP 

If the bytes are found, the address loca- 
tion of every occurrence will be displayed 
on the screen. So have pen and paper ready, 
they scroll by real fast. 

Here are some more useful monitor com- 
mands I have discovered. The list may not 
be complete if someone has more, please 
send them in for the rest of us to see, also is 
there is a reference manual or anything in 
using the monitor and where can I get a hold 
of one? And what function does the Memory 
Pecker CDA serve? 

Ilgs monitor commands (partial list): 

Ctrl E Displays all registers and values in 
them. (I don'tknow how to change them) 

Ctrl B Cold starts into BASIC (you lose 
any basic program in memory.) 

Ctrl C Warm starts into BASIC (you keep 
any basic program in memory.) 

Ctrl R Restores registers to startup values 
(OK,., so I can reset them) 

Ctrl T Sets screen to text page one (useful 
for program crashes) 

N Sets screen to normal mode 

I Sets screen to inverse mode 

! Goes into the mini assembler 

= decimal value Decimal to Hex conver- 
sion (very useful) 

hex value = Hex to decimal conver- 
sion (bank/address) 

addrL Disassemble code starting at ad- 
dress 

bank/address . bank/address Displays 
range of memory 

esc 8 Sets screen to 80 column mode, 
also works while in BASIC 

esc 4 Sets screen to 40 column mode, 
also works while in BASIC 

Playing Tip for... 

Ancient Land of Y's 

9 

Last but not least is a playing tip for 
Ancient Land of Y's using the handy dandy 
Visit Monitor CDA. (I'drather use the mon- 
itor than editing the save disk as this will 
save time. I can edit and go right back into 
the game instead of having to reboot.) En- 
able your CDA for Visit Monitor. The 
character is located in memory locations 01/ 
71E4 to 01/71F4? This is a breakdown of 
what I've found so far. 
01/71E4 Char Hit Point (max $FF) 
01/71E6 Char Hit Point minus damage 
1/7 1E8-9 Experience points 

01/71EE-F Money 

01/71F2 Strength 



Changing your experience points seems 
to be the best bet, since when you move up 
a level your hit points and strength are reset 
to what they should be plus a gain for level 
advancement. The maximum experience 
points is FF FF which is 65535 in decimal. 
This will give you 255 hit points and a level 
of 7. 1 haven't found the location for weap- 
ons or armor, but increasing experience 
points and boosting money seems to work 
for me. 

©After playing the game for a while I 
am now stuck in the mines (try to map 
realistic caverns on graph papa") and if 
anyone knows how to get through, your 
experiences would be greatly appreciated. 

Well, that's it. Hope this helps someone. 
Keep on computing. 



Edison 



NE 



BUG in Super 6.0 Fastcopy 

There are two errors in the program SU- 
PER 6.0 FASTCOPY A both on the disk and 
in the listing of issue #72 page 21. They are 
corrected here. 

500 VT=9: FOR 1=7 TO 12 

530 IF CH$ = "N" AND 1-12 THEN 580 



Softkey for.. 



Double Check 



Upon booting this disk you see the "]'' 
meaning, hopefully, a near normal DOS. I 
tried to copy the disk with Locksmith Fast- 
copy and got all errors. This tells me to 
suspect everything. Looking at the disk with 
a nibble editor, (CopyII+, The Nibbler) you 
will find the normal bytes are changed from 
DE AA to AA AA on both the Address and 
Data epilogs. Very easy to correct but which 
method should I use? Try any of these. 

The COPYA method 

The COPYA method may or may not 
produce errors on the duplicate. 

1. Boot a DOS 3.3 system disk. 

2. Tell DOS to ignore checksum and epilog 
errors and use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

Using SUPER 6.0 FASTCOPY 

Select (L)ocksmith 



L 

1 

Y 

N 

N 

N 

AA 

N 

Y 

N 

N 

N 

AA 

N 

N 

4 



read bytes 
Alter Address bytes 



Change from DE 
Alter Data bytes' 

ChangefromDE 



Enter LS Fastcopy 

Super lOB method 

Merge the following controller with 
SUPER lOB and run it. 

Controller 

1000 REM DOUBLE CHECK. CON 

1010 TK = 0:ST = 0:LT = 35:CD = WR 

1020 Tl = TK: GOSUB 490: RESTORE : 

GOSUB 170 
1030 GOSUB 430: GOSUB 100: ST = ST 

+1: IF ST < DOS THEN 1030 
1040 IF BF THEN 1060 
1050 ST = 0:TK = TK + 1: IF TK < 

LT THEN 1030 
1060 GOSUB 230: GOSUB 490:TK = 

T1:ST = 
1070 GOSUB 430: GOSUB 100: ST = ST 

+1: IF ST < DOS THEN 1070 
1080 ST = 0:TK = TK + 1: IF BF = 

AND TK < LT THEN 1070 
1090 IF TK < LT THEN 1020 
1100 HOME : PRINT "DONEOWITHOCOPY" 

: END 
5000 DATA 170,170,170,170 



Checksums 

1000-$356B 1040-$51E4 1080-$BA6E 

1010-$3266 1050-$FDC1 1090-$CD24 

1020-$7F0A 1060-$40I6 1100-$83FF 

1030-$690B 1070-$4813 5000-$6139 

The edits are not in this controller be- 
cause I didn't think you would want to type 
78 Data statements. 

Boot a sector editor and change all these 
locations. 



Irk Scl eyt? 


From 


l2 


$03 $06 $CB 


313730 


32 32 32 


$D6 


313730 


32 3232 


$07 $02 $60 


313730 


32 3232 


$6B 


313730 


32 3232 


$07 $03 $18 


3137 30 


32 32 32 


$23 


313730 


323232 


$12 $08 $BD 


313730 


32 3232 


$C8 


313730 


32 3232 


$12 $0C $26 


313730 


32 32 32 


$31 


313730 


32 3232 


$13 $08 $33 


313730 


32 3232 


$3E 


3137 30 


32 32 32 


$13 $0E $4A 


313730 


32 3232 


$55 


31 37 30 


32 32 32 


$DF 


313730 


32 3232 


$EA 


313730 


32 3232 


$18 $0B $C5 


313730 


32 3232 


$D0 


313730 


32 3232 


$1B $01 $39 


313730 


323232 


$44 


3137 30 


323232 


$4F 


313730 


323232 


$5A 


313730 


323232 


$1E $0C $D0 


313730 


32 3232 


$08 


313730 


32 3232 


$21 $0C $F2 


313730 


32 3232 


$FD 


313730 


32 3232 



After converting this disk to normal for- 
mat AND editing it, you may copy the files 
to a fast DOS that has the VERIFY com- 
mand intact. These programs change control 
from one another by BLOADing code into 
memory then changing the Applesoft start 
of program pointer to the new code, leaving 
all variables intact. I think it is a very nifty 
trick. It also made it VERY difficult to 
change the POKEs that mess up DOS when 
its looking for the original. 

ji ' Menu Program 

When I booted the disk for issue #72, 1 
noticed a small seven sector menu program 
that does nothing but run a choice from the 
Catalog. I thought to myself what a waste of 
space, I have been using a three sector menu 
program for several years that does that! 
Wondering if someone else could use it, I 
decided to send it in. Then I thought to 
myself 'this could be a lot better', so I 
rewrote it and now it loads, locks, unlocks, 
deletes, and renames files also. It still only 
takes five sectors, plus it is easily modified. 

Line 100 - CATALOG the disk. 

Line 1 10& 120 -print the letters and brackets 
then set the string that prints at the bot- 
tom. 

Line 130 - print the siring while waiting for 
a key press. 

Line 140 - set command, if not a number 
then 220. 

Lines 150-200 - reset command. 

Line 210 - get letter of program. 

Line 220 - check if letter is on the menu. 

Line230 - check if program is binary. 

Line 240 - check if text. 

Line 250 - read name of file and add to 
command string, if rename command 
then 270. 

Line 260 - print command then do it, END. 

Line 270 - get new name for file then 260. 

Line 280 - subroutine that checks the screen. 

Menu 

100 CLEAR : SPEED= 255: NORMAL : 
HOME :D$ = CHR$ (4) : PRINT D$ 
"CATALOG" 

110 T = 0:CH = 4: FOR CV = TO 
23: GOSUB 280: IF C > 175 AND C 
< 186 THEN POKE P - 1,219: POKE 
P,T + 193: POKE P + 1,221:T - T 
+ 1:S = CV 

120 NEXT CV: VTAB 24:A$ = "TYPEO 

letterOtoOrun, OorOload=iOlock-20 

UNLOCK=30DELETE=40RENAME=50EXIT 

=6 " 

130 HTAB 1: PRINT LEFT$ 
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(A$,39);:A$ = MID$ (A$,2) + 

LEFT$ (A$,1):K - PEEK ( - 

16384) : IF K < 128 THEN FOR K = 

1 TO 75: NEXT K:K = FRE (0) : 

GOTO 130 
140 TEXT :B$ = "RUN" : POKE - 

16368, 0:K = K - 176: IF K < 1 

OR K > 6 THEN 220 
150 HTAB 1: CALL - 868: IF K - 6 

THEN END 
160 PRINT "OPRESSO' LETTER' OYOUOWISH 

OTOO" ; : IF K = 1 THEN B$ = 

"LOAD" 
170 IF K = 2 THEN B$ - "LOCK" 
180 IF K = 3 THEN B$ = "UNLOCK" 
190 IF K = 4 THEN B$ = "DELETE" : 

FLASH 
200 IF K = 5 THEN B$ = "RENAME" 
210 PRINT B$; : CALL - 198: NORMAL 

: GET K$:K = ASC (K$) - 48 
220 IF K < 17 OR K > T + 16 THEN 

130 
230 CH = 1:CV = S - T + K - 16: 

GOSUB 280: IF C = 194 AND (B$ = 

"LOAD" OR B$ = "RUN" ) THEN B$ 

= "B" + B$ 
240 IF C = 212 AND B$ = "RUN" THEN 

B$ - "EXEC" 
250 FOR CH = 6 TO 39: GOSUB 280:B$ 

= B$ + CHR$ (C) : NEXT CH: IF GE 

= 1 THEN 270 
260 HTAB 1: CALL - 868: PRINT B$: 

PRINT D$;B$: END 
270 B$ - B$ + "," : PRINT : INPUT 

"WHATODOOYOUOWANTOTHI S0PRCX3RAM0 

RENAMEDOTO" ;T$:B$ = B$ + T$: 

GOTO 260 
280 CI = INT (CV / 8) :C2 = CV - CI 

* 8:P = 1024 + 128 * C2 + 40 * 

CI + CH:C = PEEK (P) : RETURN 

Checksums 

100-$7F0F 170-$0EA1 240-$589B 

110-$606F 180-$523B 250-$E247 

120-$2607 190-$2F05 260-$6B89 

130-$8907 200-$F3F8 270-$2FFC 

140-$3A84 210-$4C72 280-$lA23 

150-$1A3D 220-$lB18 

160-$C89D 230-$45DC 

I use this almost exclusively. The only 
thing I didn't really like about the program 
was that it shows a standard catalog of all 
files. I used to rename secondary files 'A' 
with several ctrl Hs to hide the names, but 
the only way to access these was with spe- 
cial loader programs. Now thanks to Zono 
in #72, all I have to do is Unlock the files I 
don't want showing and add these two lines 
to menu for locked files only. 

Patch DOS to not show unlocked files. 

95 POKE 44452, 255:P0KE 44513,67 

Fix DOS. 

105 POKE 44452, 22 :P0KE 44513,2 

Add this if you have a Pronto-Dos that 
uses the TYPE command. 

245 IF C=212 AND B$="L0AD" THEN 
B$="TYPE" 

Otherwords 

I for one am sick of looking at that LONG 
Most Wanted List. It seems most have been 
covered before in back issues and in the 
books of softkeys. Please look in the back 
issues first! For those who don't know, you 
may get a complete back-issue list from 
Computist for the amazing low price of one 
self addressed 9 x 12" envelope with $.45 
postage on it. 

The easiest way is to send a 65( stamp 
(only) and ask for the back issue list. No 
point in paying the postage for a 9" x 12" 
envelope twice KDEXed 

Help needed 

® I need help with Clue Master Detec- 
tive V 1 .5 by Leisure Games. Here's how far 
I got. Booting this disk you see it is ProDOS 
based. So I tried to copy the disk with 
Locksmith Fastcopy and got Data errors. 
This tells me the address headers (epilogs) 
and trailers (prologs) are OK. That leaves 
the Data epilogs and/or data check sums 
and/or prologs at fault. Looking at the disk 
with a nibble editor, (CopyII+, The Nibbler) 
you will find the Data epilog bytes are at 
fault The normal bytes are changed from 
DE AA EB to AA DE EB. Through trial and 
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error I found out this disk MUST be format- 
ted with a volume number of one. (Is that a 
ProDOS limitation?) Boot a sector editor 
and change this byte in the ProDOS file so it 
will load from the disk. Change track $21, 
sector $07, byte $C8 from AA to DE. Here's 
where I need help. The copy will 'randomly' 
freeze the game or select two rooms instead 
of a room and a weapon. There is some code 
on track one that I think is a signature check. 
It starts like this... 



AD30BF 


LDA $BF30 1 




29 7F 


AND #$7F 1 


•> get slot 


AA 


TAX 1 




BD89C0 


LDA $C089.X 


turn on drive 



More help needed 

I have decided that I am tired of looking 
at my stack of unused software. I am in 
serious need of clues, hints, patches, and 
outright answers to several computer video 
games and almost all of my text adventure 
games. 

® A good example would be Zorro by 
Datasoft 1985. 1 am confident that I have 
mastered the game. My high score is over 
78,000 but I still can't finish the game! How 
do I get the rose? Here is what I have 
collected, in order- handkerchief, boulder to 
last pully, wine glass, horseshoe, 2 bells, 6 
bags of money, and the boot What have I 
missed? 

©Dark Lord by Datasoft 1987 has de- 
fied completion for over two years by me, a 
friend with an apple, and my cousin to 
whom I must loan my computer. How do I 
get past the Guard? Is there another way in? 

® I purchased the Zork Trilogy because 
I liked the Eamon text adventures. After 
playing Zmk I for a few weeks I was ex- 
tremely frustrated so I purchased Zork I with 
on screen hints. I have cheated and read all 
the clues so I am sure I have mapped every- 
thing and been everywhere but I still haven't 
completed the game. That #@*&% thief 
keeps stealing the torch then my lantern 
goes out. 

©Deciding Zork was too hard I pur- 
chased Wishbringer by Infocom 1985. It 
says 'IntroductoryLevel'butlcan'tseemto 
get any where. I have gotten back across the 
bridge but I am lost from there on. What am 
I supposed to be doing? 

I like to consider myself of above aver- 
age intelligence and I love the challenge of 
mapping these games, but my skills as an 
adventurer are nil. It should be noted that I 
almost always win at Conan, Karateka, 221 
B Baker St., Clue Master Detective, and 
Wheel of Fortune. I had an almost complete 
map for Below the Root before it blew up. A 
lot of my software is old so clue books are 
hard to find. 

I would like to see enough interest gener- 
ated from my tales of frustration to add a 
Questions and Answers section to Computist. 
Maybe a half a page or so, not too big, just 
enough to help all of us who are quietly 
pulling our hair out. I would love to hear 
from people who have completed these 
games, either directly or through Comput- 
ist Here are a few of the games I need help 
with. Ultima I - III, Zork I - III, Wizardry 
Proving Grounds, Gemstone Warrior, 
Plundered Hearts 



Ephraim Santiago 
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Softkey for... 

Moptown Hotel vl.3 

The Learning Company 

Requirements: 

The original Moptown Hotel disk (5.25") 

1 blank disk 

COPYA 

Copy II Plus 

Any disk with normal DOS 3.3 

This softkey would not be possible if it 
weren't for the softkey from Jack R. Nissel 
on Reader Rabbit in issue #68 , page 22. 1' ve 
tried all those other softkeys in previous 
issues and got nowhere with those compli- 
cated methods. 

1. Boot your DOS 3.3, system master disk 
and at the "]" prompt enter. 



POKE 47426,24 ignore checksums and epilogues 
, RUN COPYA 

2. Put your original away and boot Copy II 
Plus. Use the COPY DOS function to 
copy normal DOS 3.3 from any disk to 
your copy, (target disk). 

3. Now select the Change Boot Program 
function from Copy II Plus to make sure 
that the Boot Program name is HELLO. If 
it is not, then use this function to change it 
to HELLO. 

The Last Print 

I've been a subscriber for about a year 
no w and I ' ve been reading all these negative 
comments about the way Computist is print- 
ed or how the price is outrageous. Let's not 
mention any names, you know who you are 
and your complaints. 

I appreciate the hard work that's put into 
this paper and the information. After all if it 
weren't for Computist where else could we 
look forward to for Apple He, Ilgs, Mac, and 
IBMand its programs in terms of backing up 
your software and the vast amount of 
technical information. 

Do you ever stop and think what would 
you do without Computist or if it just went 
under because of lost subscribers or finan- 
cial reasons, or maybe the volunteers who 
donate their time and effort so that we could 
just sit back and wait for that next great issue 
of Computist that we take for granted. I 
think it's that time again where we should be 
asking ourselves how can we help to insure 
the survival of this subscriber supported 
magazine, tabloid, or call it what you like, 
but one thing's for sure "When it's gone, it's 
gone!" 

Softkey for... 

Animal Kingdom 

Unicorn Software 

Requirements: 

DOS 3.3 
C(^y 11+ 
One blank disk 

The credit goes out to Spike. In issue #69, 
Spike informs us on how to backup All 
about America for the Apple He 5.25" disk. 

Animal Kingdom uses only one disk 
which is doubled sided. To make a back up 
use the following steps. 

Remember: ALWAYS write protect your 
original disk. 

1. Boot your DOS 3.3 system disk. 

2. Tell DOS to ignore checksum and epilog 
errors and use COPYA to copy both sides. 

POKE 47426,24 
RUN COPYA 

3. Boot Copy 11+ and delete the DOS image 
from your target disk. (Not your original 
disk) 

4. Copy DOS from your DOS 3.3 system 
disk onto your target disk. 

5. Rename the file "Jello" (on your target 
disk) to "Hello". That's it! 

You know have a deprotected backup. 
Have fun! 



The CPR Agent 



Canada 



Softkey for... 

French Grammar I- VII 

Queue/Intellectual Software 

These programs are designed to review 
the basic grammar structures of the French 
that is studied in schools. There are ten 
lessons on each disk which includes a re- 
view lesson. The form of the program is very 
standard and has a no-bells-and-whistles 
approach. A teacher management module 
can be purchased separately (for $ 10 a disk) 
but you must send your disk back to have it 
installed. Luckily one of the disks in the set 
that I worked with had the management unit 
installed. It took no time at all to figure out 
that the other disks were only missing a 
couple of files. After transferring these files 
to the other disks, they too had a teacher 
management module to keep track of the 
averages of the students who used the disk 
— and it didn't cost $10 a disk! 



The de-protection of these disks (and all 
Queue or Intellectual Software disks that I 
have worked with) is very standard and, in 
fact can be used on all the disks. 

1 . Capture the RWTS from one of the disks 
using your favorite technique. (If you 
have trouble getting this, find a friend or 
neighbor who has a Laser computer. The 
CONTROL-RESET M technique for get- 
ting into the monitor on these machines, 
works marvelously well!) Keep this 
RWTS around as it seems to work on 
everything Queue puts out! 

2. Once you have the RWTS, simply use it 
•with Super lOB and one of the SWAP 

CONTROLLERS to copy the disk. 

3. Use Copy II Plus (or a similar utility) to 
change the boot file from "HELLO" to 
"BTUT' (or the first file in the list - it was 
BTUT on every disk that I worked with in 
this series.) 

The de-protection is done — unless you 
want that teacher management module on 
each of your disks. To get it, you first have 
to have it aheady installed on one of your 
programs or one of your friends programs. 
Simply copy the TUT file and the ACSES 
file (both Applesoft) from the disk with the 
teacher management module to your disk. 
You will find that your copy program will 
tell you that the TUT file already exits on 
your disk. Copy over it with the new TUT 
file. Your original TUT file occupies only 
50 sectors while the one with the manage- 
ment module covers 59. The code for ac- 
cessing this management area is Ctrl M at any 
time the program is not asking for a specific 
answer to a question. I should say, it is Ctrl 
M for all Apple II's and II+'s. For the Apple 
He's, He's, and the Laser computers, it's 
Ctrl ]. After copying the files, it would be a 
good idea to check it out to make sure it 
works. 

One word of caution. Be careful with the 
lesson files on the disk as they all have 
control characters embedded in their names. 
There is really no reason to touch them 
unless you are that enterprising teacher out 
to add a little character and flavor to these 
otherwise rather drab French exercises! Fi- 
nally, be sure to use a fast DOS — or patch 
DOS 3.3 with any one of several fast patch- 
es. Diversi DOS is a gdod choice since it 
handles text files particularly well and seems 
to be very compatible with most programs. 
The fast patch that comes as part of Ad- 
vanced Ideas' Ultra Disk Pak works very 
well too. 

Softkey for... 

Alphabet Circus 

DLMINeosoft 

This is an excellent program for teaching 
pre-schoolers and first grade students the 
alphabet There are six different programs 
on the disk to keep the learning activity 
varied and the motivation high. 
Requirements: 

fast copier (I used Copy II Plus) 
sector editor Q. used Copy II Plus) 

1. Fast copy the disk (there are no errors or 
glitches). 

2. Sector edit: 

Irk Set Byte From la 

$06 $0D $5F-60 A956 6060 

Or search for BD 89 CO A9 56. It can be 
found in the file HELL03. 

Details 

This program uses one of the shorter 
DOS's and then fills the entire disk with 
program. Consequently, if you try to ttans- 
fer all the files to another disk, you get the 
joyous DISK FULL message before you 
finish the file transfer. After several at- 
tempts to make enough space to actually 
transfer all the files, (and failing!) I discov- 
ered the best thing to do was to leave it all on 
the fast copied disk and search for the signa- 
ture check. 

I decided to begin this process by exam- 
ining the files on the disk, only to discover 
that track $11 was empty! I found the cata- 
log on Track $03 and moved a copy of it 



sector by sector back to track $1 1 where it 
ought to be. (This is actually a pointless 
exercise since the program could care less 
what is aa track $ 1 1 — it looks to Track $03 
for its directions. But seeing the catalog on 
Track $ 1 1 makes ME feel much better about 
everything!) 

In looking over the catalog I noticed 
three Hello files — HELLO, GAME. HEL- 
LO, and HELL03. The first two are Apple- 
soft BASIC, easily loaded and listed. Noth- 
ing seemed unusual in either. The third one, 
HELL03, was a binary file occupying 2 
sectors (one sector actually, since the first 
simply pointed to the second). I was imme- 
diately suspicious. I disassembled and there 
it was, a nice little signature check for sev- 
eral non-standard bytes. I placed two 60's 
right after the instruction to turn the disk 
drive on and gave it a try. It loaded and ran 
more smoothly than the original. QED! 

Softkey for... 

Early Games - Music for Children 

Counterpoint Software 

Requirements: 

HD (from the DOS Master) 

an inidaUzed disk (preferably with a fast 

DOS) 
Copy II Plus (or similar utility for changing 

the boot file on a DOS disk) 

This is an interesting piece of software 
that allows children to develop short musi- 
cal routines in the bass or treble clef, save 
them, and play them back. It also has a 
routine for putting kaleidoscopic graphics 
to the music — something children would 
very much enjoy. Finally it has the facility to 
quiz children on musical notes, sounds, etc. 
Of course, the real problem with diis pro- 
gram is that it is copy protected. Once again 
we have a potentially excellent program 
delicately balanced under the umbrella of a 
copy protection scheme that will crash die 
whole disk the minute a youngster (for whom 
the program was designed) does something 
out of the ordinary that the computer doesn ' t 
expect A very intelUgent move. Counter- 
point! 

Step-by-step 

1. Boot your DOS Master and. 

CALL -1 51 enter the monitor 

B954:29 00 ignore 1st byte ofAddr Prologue 
BRUNFID 

2. Use FID to copy the files. Follow the 
prompts (Use the wildcard "=" for the file 
name and answer "N" to the "Do you want 
to be prompted?" question). 

3. Use Copy II Plus (or similar facility) to 
rename die boot file the first file on the 
list. 

Details 

There are really only two or three poten- 
tial problems to de-protecting this disk. I 
used HD rather than COPYA because track 
$04 was all FF's and die first three uacks 
had an altered Address Epilogue. Radier 
than have my disk drive "ratde" through 
track $04 and rather dian try to get the 
somewhat delicate balance of ignoring pro- 
logue AND epilogue changes, it seemed a 
better idea to go widi FID. However, it was 
a bitof a surprise to watch FID copy the first 
several "blank" files! FID seemed to be 
copying files that had no name! This, I 
remembered, was a sure sign of files that 
were masked by control characters. The best 
way to handle diese files is to NOT get into 
a position where you have to enter the name 
of the file. Hence, let Copy II Plus (or other 
similar utility) identify the first file as the 
new boot file. After that final change, die 
disk works fine. 

Sofdcey for... 

French Word Games 

EMC 

Requirements: 

COPYA 

DOS System Master disk 

Copy II Plus 

This is another of those review programs 
that helps get away from the classroom 
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routine and yet jMDvides some very valuable 
instruction. There are three games on the 
disk — students can play by themselves or 
against a partner (a good choice if there are 
not enough computers to go around!). The 
games include matching, choosing the one 
that does not fit, and opposites. About 1500 
words are taught and no specialized com- 
puter skills are required. 

Step-by-step 

1. Boot your DOS 3.3 system disk. 

2. Remove the master disk and insert a blank 
disk in the drive. Initialize a disk with 
HELLOl. Set the disk aside. 

INIT HELLO! 

3. Tell DOS to ignore address epilogs and 
use COPYA to copy the disk. 

POKE 47503,14 
RUN COPYA 

4. Use Copy II Plus, FID, or similar utility to 
transfer all the files from the COPYA disk 
to the initialized disk. 

Details 

A fast DOS is not necessary as this pro- 
gram has 2 short routines that it loads imme- 
diately upon booting that put regular DOS 
3.3 into hyper-drive! Perhaps they could be 
used in other places on other disks?! ! They 
are called SPEEDOS 1 .OBJ and SPEED0S2 
.OBJ and each is a binary file of 2 sectors. 

Softkey for... 

GarHeld, Eat Your Words 

Random House 

Requirements: 

COPYA 

sector editor (I used Copy II Plus) 

Step-by-step 

1. Boot your DOS 3.3 system disk. 

2. Tell DOS to ignore checksum and epilog 
errors and use COPYA to copy the disk. 

POKE 47426,24 
RUN COPYA 

3. Make the following sector edits to the 
copy. 

Ids SeJ B^ From la 

$00 $03 $91 AA DE 

$9B DE AA 

$06 $AE AA DE 

$B3 DE AA 

That's it! 

Notes on Les Secrets de Gertrude 

Two of the programs that caused me the 
greatest consternation in de-protection were 
Gertrude's Secrets and Gertrude's Puzzles, 
both by the Learning Company. The reason 
they were such a challenge was because they 
both used half tracks as part of the encryp- 
tion - at least the copies that I had both used 
half tracks. I spent many hours devising 
ways to access the data from the originals 
and getting it back on to a standard disk. All 
to no avail. Since Copy II Plus would back 
the disk up, I was in no rush to have a de- 
protected copy. But like a tiny rock in your 
shoe, it is always a bit of a pain. 

So when our media center acquired a 
copy of Les Secrets de Gertrude (Gertrude's 
Secrets in French!), some lights came on 
and the laboratory of my mind began conjur- 
ing a scheme! The big bonus with the French 
program was that I noticed the distributor 
was Gessler - a company that I had encoun- 
tered before and had litde trouble with. The 
plan that chased around in my mind as I 
drove the disk home was to rid the disk of 
Gessler' s protection technique, call up the 
sectors that had the instructions with a sector 
editor, change (translate) the instructions 
from French back to English, write it all 
back to the disk, and PRESTO an English 
version of the program without the pain of 
half tracks! Since I could handle myself 
reasonably well with the written form of the 
French language, I was confident that with a 
littie luck I could perform one of the ulti- 
mate sneaky hacking tricks. 

As I examined the disk there were, as you 
may have guessed, a number of surprises. 
This time, however, they were all in my 
favor. Surprise number one was that the disk 



was not copy protected at all! I was elated. I 
checked and rechecked as I could not, at 
first, believe it. The second surprise came as 
I located the French instructions using the 
sector editor. I began carefully substituting 
words and letters, hoping that I wouldn't 
mess up some call routine by not enough of 
one or too many of the other. During this 
process, I began searching for the proper 
value to enter for an "x" and not finding it on 
the sector where I was presenUy working, I 
wrote what I had changed to the disk and 
began backing up tiirough other sectors, 
looking for an "x" somewhere. 

Lo and behold I ran into a sector in 
English! I stared in disbelief again! What 
recklessness was this? I determined that the 
program probably had some key press that 
you could enter in the middle of whatever 
you were doing, and you could "help" your- 
self with your problem by having an instant 
English translation. It was a good idea but I 
was wrong. As it turned out, the whole of 
that particular file was EngUsh. I asked an 
immediate question (out loud, I might add) 
"How many other files do we have on this 
disk that are in English?" After several 
minutes of careful rummaging through files 
and sectors the answer tumed out to be "All 
the necessary files (including the HELLO 
file) for an English version of this program 
are already here on the disk! ! " I was stunned! 
I have no idea why a software company 
would do this but I am most MOST grateful 
to them! 

What is to be learned from all this? Two 
things. First and most important is that 
sometimes the answer to our immediate 
problem is so obvious that it is overlooked. 
(I may have spent hours and hours translat- 
ing the instructions and never ever even 
realized that the solution was next door in 
the previous sector!) Secondly, there may 
be more information on an innocent disk 
than we even realize. Since this particular 
program is fairly short, there is room on the 
disk for both versions and then some. Finally, 
it is sometimes interesting and very worth- 
while to check a de-protected disk for deleted 
files. On one of my program^ I found three 
deleted files that proved to be evolutionary 
stages of growth for one of the actual func- 
tional files in the program. It was an educa- 
tion in programming to follow the "thinking" 
of the programmer as he developed the file. 

Now for Gertrude's best guarded secret. 
If you have the program Les Secrets de 
Gertrude in your library, here's how to have 
two programs for the price of one! 

1. Boot a DOS 3.3 disk. Insert a blank disk 
and initialize it (with a fast DOS) so that 
it wiU BRUN FRESHSTART.O as its 
Hello file. 

POKE 4051 4,52 to let the hello be binary 

\m FRESHSTART.O 
DELETE FRESHSTART.0 

2. Copy the following files from your orig- 
inal disk to the copy. 

FRESHSTART.O 

SECRETSHELLO.O 

SECRETLOGO 

OLD SECRET WORLD. I IE 

OLD SECRET WORLD 

SECRETCODE.O 

SECRETSGOOSE.O 

SECRETSRANDOM.O 

OLD SECRETFONT 

ADV #108 

3. Rename the following files: 

from tQ 

OLD SECRET WORLD.IIE SECRET WORLD.IIE 

OLD SECRET WORLD SECRET WORLD 

OLD SECRETFONT SECRETFONT 

Please note Uiat it is the letter "O" that 
follows the period in several of the files and 
NOT the number "0". 

That's it! Whoever would have guessed 
that the French were the guardians of Ger- 
trude's best kept secret?! Viva le hacking! 



Softicey for... 

Chariots, Cougars, and Kings 
Kittens, Kids, and a Frog 

Hartley 

Requirements: 

COPYA (or COPY A+) 
sector editor 

These are two fairly good programs that 
address reading comprehension in the pri- 
mary grades. They are essentially stories 
(short) tiiat the student is required to read 
and then there are a number of questions that 
the student is required to answer. Some 
educators would say that you could do just 
as well on paper with a lot less hassle. Others 
would say that the immediate feedback of- 
fered by the computer to an incorrect answer 
is much better than the red X — and the 
computer keeps track of it all. Further, there 
are some (a few) excellent graphics that go 
with the program. The biggest problem is 
that they are both copy protected which 
means that the disk will go down in no time 
at the hands of the "littie people." So we 
shall do away with that problem. 

Step-by-step 

1. Use your System Master, your favorite 
method, or whatever to get to COPYA. 
(Note: use COPYA+ to achieve the same 
results as below if you wish.) 
RUN COPYA 

Ctrl C At the first prompt 

70 to prevent reloading COPY. OBJ 

CALL-1 51 enter the monitor 

B925:18 60 to ignore data epilogues 

B988:1 8 60 to ignore address epilogues 

BE48:18 to ignore errors 

Ctrl C to get back to BASIC 

RUN to start up COPYA again 

Follow the prompts and copy both disks. 

2. Make the following sector edits to the 
copy. 

From la 



Trk Set Bvte 

$00 $02 $9E 

$00 $03 $35 

$00 $03 $91 



D5 
D5 
D5 

Details 



DE 
DE 
DE 



These programs were embarrassingly 
easy. There was a single technique used for 
copy protection and it was probably one of 
the oldest and simplest — changing the 
epilogues to the address and data portions of 
the sector. Perhaps it is yet another sign that 
companies are tiring of the "game" and are 
going to be more cooperative in the future, 
especially in the field of education. 

Any one who is at all familiar with BA- 
SIC could have some real fun as most of the 
files are written in BASIC on these disks. 
Changing the way some of the files work 
and perform would certainly add a local 
flavor to the stories and routines. Enjoy! 

Softkey for... 

Kidwriter 1.0 

Spinnaker 

Requirements: 

Fast copier 

DOS (a fast one helps) 

a way to change tiie boot program 

Since none of the previous Spinnaker 
information helped me with this one, I 
thought I would send this in just in case 
someone else out there had the same prob- 
lems I had. 



Step-by-step 

1. Fast copy the disk (ignore the error on 
track $00). 

2. Copy all the files from your copy to 
anotiier disk that has your DOS already on 
it 

3 . Use your boot program changer to change 
Uie boot file from "G" to "J". (See below.) 

Details 

The trick to getting this program working 
properly is being able to work around the 
control characters in the files. If you are 
using a copy program other than Copy II 
Plus, please modify the explanation accord- 
ingly. 



The fast copy part of the deprotection is 
very straight forward. Ignore the error on 
track $00. Once you have your fast copy, tell 
Copy II Plus to CATALOG the disk show- 
ing the hidden characters. Surprise! How 
about that mess of sneaky glitches! Not to 
worry. When we copy these files to another 
disk using Copy II Plus, the file names are 
left intact and we don't have to worry about 
getting the proper control characters in the 
right places. 

So initialize another disk with your fa- 
vorite DOS (I noticed that they used Pronto 
DOS. You may have to try a different one if 
your favorite doesn't work. I usedapatched 
DOS 3.3 and it seemed to work fine.) Then 
copy all the files from your fast copied disk 
to this new disk. As I said before, Copy II 
Plus handles the control characters in the file 
names just fine. 

Once you are finished copying all the 
files over, tell Copy II Plus that you want to 
CHANGE THE BOOT PROGRAM. When 
it gives you the list of files, highlight the "J" 
file and press the "G" for GO. (The reason I 
placed this file in quotation marks is because 
the file really isn't just a "J" but has several 
control characters surrounding it. But it ap- 
pears as a "J" on the file menu.) This proce- 
dure bypasses the regular boot file which 
appears on Uie menu as a "G" and also 
contains the signature check routine. Leav- 
ing it out simply puts the program into 
motion without the disk check and the pro- 
gram now boots up faster. You now have a 
perfectiy COPYA-able deprotected KID- 
WRITER that you can safely allow children 
to use (without all those nightmares about 
replacement costs and delays!). 

Softkey for... 



Cloze Plus Program 

Milliken 

Requirements: 
COPYA 
sector editor 

This program is a "context analysis" 
reading program made up of 6 sets of dis- 
kettes with 4 diskettes in each set. Each set 
of diskettes is designed for a specific read- 
ing level, starting at reading level 3 and 
proceeding up through reading level 8. Each 
diskette has a Manager routine built in such 
tiiat the teacher can keep track of the progress 
of up to 100 students. It is an impressive 
program but has two flaws: 

1. The program and the student data are 
all on the same side of the disk. If a student 
"diddles" tiie disk, the teacher loses all his/ 
her data! 

2. The program is copy protected which 
multiplies the hazard in 1. 

I can't do too much about #1 except 
recommend you keep backups of the depro- 
tected disk. And here is how to obtain your 
deprotected disk. 

Step-by-step 

1. Copy the disk using COPYA and ignore 
address and data epilogues. 

POKE 47426,24 
RUN COPYA 

2. Make the following sector edits: 



Ids Ssl Bvt? 


Froni 


I2 


$11 $00 $01 


F1 


11 


$00 $02 $9E 


DF 


DE 


$03 $35 


DF 


DE 


$03 $91 


DF 


DE 


$06 $AE 


DF 


DE 



Details 

The deprotection of this disk was very 
standard except for two details. The first 
detail is that the first sector edit above fixes 
the catalog such that files (especially those 
that contain important student data) can now 
be removed from the disk on a regular basis 
if necessary (or files can now be manipulat- 
ed in any number of ways by enterprising 
teachers). Secondly, the teacher handbook 
that comes with the program draws special 
attention to the speed of disk drives and how 
important the proper speed is to the opera- 
tion of the program. I was suspicious about 
this warning and determined that I would try 
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it out once I had the deprotection intact. 

I found the disk speed check on track 
$00, sector $0A at the end of the sector. As 
the program checks for the standard Ad- 
dress and Data marks, it goes on to check for 
two FF bytes. I thought to myself that this 
would be a rather ingenious way of sUpping 
in a protection scheme under the disguise of 
a disk speed check and consequently fooling 
the apprehensive hacker. I decided the best 
way to check would be to change my disk 
drive speed, edit the routine out of a copy, 
then see if the original disk and the copy 
gave the same results. 1 did just that. How- 
ever, to my surprise the routine proved to be 
genuine. So all I will say now is if anyone 
wants to rid their program of the check and 
live dangerously or if you have a touchy disk 
drive that you are quite certain is not going 
to be a problem with this program, simply 
replace the DO 10 at bytes $F1-F2 and DO 07 
at bytes SFA-FB (both on track $00 in sector 
$0A) with EA's. (Keep an eye on the re-boot 
instruction at byte $0E of sector $0B, track 
$00 as well!) 

Softkey for... 

Mighty Math 

Discovery Software/World Book 

Requirements: 

COPYA or COPYA+ 

Sector editor (I use COPY II PLUS) 

DOS System Master 

Note: COPY A+ is an excellent tool from 
COMPtrnST#67 page 20, comphments of 
Gerald Berry and well worth the time to type 
it in. 

Mighty Math is an excellent tool for 
teaching mathematical concepts and for drill 
exercises in basic math. It is designed for 
students at the primary level (ages 6- 1 0) and 
has excellent options (varying speed levels, 
varying difficulty levels, and six different 
activities) for keeping the program interest- 
ing. It is one of the few programs that is 
worthwhile in the field of education. So 
many are a complete waste of time and 
money. The one problem with this program 
is that it is copy protected, so let's take care 
of that right now. 

Step-by-step 

1 . Boot your DOS SYSTEM MASTER and 
RUN COPYA (or use your COPYA+ to 
achieve the same results as explained be- 
low) 

RUN COPYA 

Ctrl C At the' first prompt 
70 to prevent reloading COPY. OBJ 

CALL-1 51 erUer the monitor 

B988:1 8 60 to ignore address epilogues 

BE48:18 to ignore errors 

Ctrl C to get back to BASIC 

RUN to start up COPYA again 

2. Follow the prompts and copy the disk. 

Note: Track $03 has a special format that 
will not copy using COPYA. But since we 
have instructed our program to ignore er- 
rors, COPYA will "rattle" over the track - 32 
"rattles" in all as it tries each sector twice. 
Do not be alarmed at the noise. Go ahead and 
count if it makes you feel better! Once it 
passes this track, all should proceed very 
quiedy and efficiently. 

3. When the copy is finished, start up your 
sector editor. 

IeB §£l B^ £[am l2 

$11 $00 $01 00 11 

4. Write the sector back to the disk. 

5. Using your System Master or the Delete 
function on your COPY II PLUS, delete 
files HELLO, SSPROT$$A, and 
SSPR0T$$1. 

6. Use your System Master to get into BA- 
SIC. Replace your System Master with 
your new copy of the program. Type the 
following HELLO program: 

10 HOME: POKE 34,23 

20 PRINT CHR$(4)"MAXFILES1" 

30 PRINT CHR$(4)"BL0AD SPEEDl" 

40 PRINT CHR$ (4) "BLOAD SPEED2" 

50 PRINT CHR$ (4) "BRtTO MAIN" 

60 END 

SAVE HELLO 



7. Finally copy the DOS from your System 
Master to the new copy of the program 
that you have been making, or better yet, 
copy a fast DOS to the new disk. 

Details: 

This program gave me four hours of 
trouble. It was easy to get the COPYAed 
version. A quick look from the Nibble Edi- 
tor of Copy II Plus showed the changes in 
track $03 and the epilogue changes to the 
address header on track $11. When I spotted 
the files SSPROT$$A and SSPROT$$l it 
rang a bell in the back of my mind from a 
previous encounter I had several months 
ago with Walt Disney's Card and Party 
Shop. Since I didn't at that time have the 
back issues of COMPUTIST #50 and #5 1 to 
help me, it was a memorable wrestling match 
that took a full day to win. 

This time I did some homework — some 
research with some of the best material 
available — back issues of COMPUTIST. 
Edward Teach in COMPUTIST #51 has 
some important observations with his en- 
counter with the "SS" files in Walt Disney's 
Cartoon Maker. Also his HELLO program 
is useful. Secondly, A.L. Head's detailed 
explanation of the purpose and nature of the 
"SS" files in Walt Disney's Card and Party 
Shop is invaluable. Many thanks to both of 
these excellent operators for their help. 

My own experience with "SS" files was 
limited to a BASIC version of both. I had not 
seen a binary form of either until I encoun- 
tered this program. As I checked them out 
under the Sector Editor and disassembled 
them, it was obvious that they were not only 
in binary form but they were also encrypted! 
Hoping that they simply performed the same 
function, I took a guess and deleted them. 
Next I chose the first file from the list in the 
catalogue and (after loading a regular DOS) 
typed BRUN BOOT. The file loaded and I 
was then greeted with the final screen and 
music that ended the program! Bad guess! ! 

Next I simply did some more guessing. 
From what I had gleaned from Ed Teach, 
A.L. Head and others, it was simply a matter 
of trial and error until I got the correct 
combination. Nothing seemed to work, 
however. I even tried backing up and un- 
deleting the "SS" files and then disabling 
their functions. Again, a bad choice! 

Finally it occurred to me that the only two 
files on the whole list that were locked were 
SPEEDl and SPEED2. 1 did the BRUN on 
SPEEDl and was landed in the monitor. In 
an effort to circumvent reloading DOS and 
going through the same procedure with 
SPEED2, 1 simply used a Ctrl C to get out of 
the monitor and back into BASIC, a CALL 
-25153 to connect the DOS that I hoped 
would still be intact, and then I typed the 
command BRUN SPEED2. This time I was 
met with a BASIC prompt I was elated. All 
I had to do now was to guess the right file 
that would come next and I was home free. 
From some of my previous efforts I remem- 
bered seeing that the file called MAIN was 
one of the ones that the others often defaulted 
to at the end of their routines. So I typed 
BRUN MAIN and away the program went! 

Next I quickly wrote a new HELLO file 
that summarized what I had learned and 
what Ed Teach and A.L. Head had also 
observed. I saved it to disk and then booted 
the disk. It sang like a riverboat sweetheart! 

Softkey for... 

Cotton's First Files 

Mindplay 

Requirements: 

Fast copier (I use Copy II Plus) 
Sector editor (I use Copy II Plus) 

This program is a data base management 
system for beginning readers aged 4 to 9. 
Good start in the philosophy of data bases. 

Step-by-step 

1. Fast copy the disk (ignore the read error 
on track $0E). 

2. Sector edit: 

Ids S£l fi^ Esm. Is 

$01 $01 $02-03 A901 18 60 



Or search for 60 A9 01 8D 27 B7. Don't 
forget to write the sector back to disk. En- 
joy! 

Softkey for... 

French • Basic Vocabulary Builder 
on Computer 

National Textbook Company 

Requirements: 

a way of capturing the disk's RWTS 
Super lOB 

fast DOS (preferable but not necessary) 
slave disk (initialized DOS 3.3 disk with 

Hello file deleted) 

This is an excellent program for teaching 
and reviewing written vocabulary skills in 
French. (This company also has programs in 
Spanish, German, and Italian.) The program 
uses graphics, help, and context clues to 
assist the student in learning the written 
language. It is a good diversion from the 
regular classroom routine. 

Step-by-step 

1 . Boot the original and break into the mon- 
itor to capture the RWTS. 

1 900<B800.BFFFM move RWTS to a safe place 

2. Warm boot the slave disk. 
6 Ctrl P 

3. Replace the slave disk with the disk that 
has the Super lOB program on it. 

BSAVE RWTS.FRENCH, A$1 900, L$800 

RUN SUPER JOB 

EXECSWAP.CON 

10010 PRINT CHR$(4) "BLOAD RWTS. FRENCH, 

A$1900" 
RUN 

4. Follow the prompts and copy the disk. 

Details 

There are two disks in the package - Disk 
1 and Disk 2. You must capture the new 
RWTS from Disk 2 in order to copy Disk 2. 
But the procedure is identical and the copy- 
ing is smooth and clean in both cases. I did 
have a problem with the opening graphic . In 
both cases this was scrambled for some 
reason. However, the rest of the program 
seemed unaffected. Both disks are almost 
impossible to back up with copy programs, 
and both disks are encrypted so as to make 
the contents completely unintelligible. Once 
this "garbage" has been cleared away, files 
can be examined and modified if desired. 
Happy French lessons! 

Softkey for... 

Life Coping Skills Series: 

Forming Positive Behavior 

Increasing Self Esteem 

Building Relationships 

Communication Skills 

Plato/Control Data Corporation 

Requirements: 

initialized disks (as many as you have pro- 
grams - initiaUze with a fast DOS for best 
results) 

DEMUFHNPLUS 

These programs all belong to a set called 
the Life Coping Skills Series. Each tide is a 
kit of anywhere from 2 to 7 disks with a 
manual that is helpful but not necessary. The 
disks all contain information and instruction 
with a few simple graphics. It is very in- 
formative but not very "inspiring"! Re- 
moving the protection was the same for all 
the disks in all the kits. 

Step-by-step 

1. Boot one of the disks in the kit and use 
your favorite method to reset into the 
monitor. 

6000<B800.BFFFM move the RWTS to a safe 
place 

2. Remove the original disk and replace it 
with an initialized disk with HELLO 
deleted. 

Ctrl P to boot the disk from the monitor 

3. Remove the slave disk and replace it with 
your disk that has DeMuffin Plus on it 

BLOAD DEMUFFIN PLUS 
CALL -151 to get into the monitor 

B800<6000.67FFM mcn/e the RWTS back where 
DeMuffin+ can use it 



803G to start up DeMi^m Plus 

4. Choose CONVERT FILES, follow the 
prompts, choose the wildcard for the file 
name, and answer "N" to the "DO YOU 
WANT TO BE PROMPTED?" question. 

The files will copy smoodily and easily 
and when the process is done, so is the 
deprotection! 

Details: 

The only detail that is important is that 
you must capture a new RWTS for each kit, 
but the same RWTS can be used for all the 
disks in each kit. Also I did notice that the ki l 
called Building Relationships does not run 
on a Laser computer. After loading and 
listing the Applesoft files, I'm quite certain 
that by changing a couple of the CALLs in 
the program , all would run well on the Laser 
machines. S ince I do not know enough about 
CALLs and POKEs to really offer much 
help, I'll leave this finer point to someone 
like Marc Batchelor who laughs at the sim- 
plicity of these tasks! 

Softkey for... 

Scrambled Words 

Learning Well 

Requirements: 

COPYA 

sector editor (I used Copy II Plus) 

This program is designed to teach and 
reinforce alphabetizing skills. It offers an 
excellent alternative to the traditional drill. 
There are 4 skill levels and the word lists can 
be personalized. Another excellent Learn- 
ing Well program! 

Step-by-step 

1. RUN COPYA and use your favorite 
method to ignore Address and Data Epi- 
logues and Checksums. 

2. Copy the disk. 

3. Sector edit: 

Iijs Ssl EyJg Essm. la 

$00 $02 $9E BF DE 

$03 $35 BF DE 

That's it! 

Softkey for... 

Puzzle Tanks 

Challenge Math 

Explorer Metros: A Metric Adventure 

The Whatsit Corporation: Survival 

Math Skills 

Number Quest: Binary Search Games 

The Kings Rule: Mathematics & 

Discovery 

Incredible Laboratory: Strategies in 

Problem Solving 

Fun House Maze: Strategies in Problem 

Solving 

Code Quest: Practice in Problem Solving 

The Pond: Strategies in Problem Solving 

The Factory: Strategies in Problem 

Solving 

Sunburst 

Requirements: 

original disk 

initialized disks - HELLO deleted (use a fast 

DOS) 
Super lOB with the Swap Controller 
Copy II Plus (or similar utility for changing 

boot files) 

All of the following Sunburst titles can 
be deprotected with the same RWTS cap- 
tured from any one of the disks: 

Step-by-step 

1. Use your favorite method to capture the 
RWTS fi^om any one of the above pro- 
grams. Save it to the same disk as your 
Super lOB program. 

2. Run your Super lOB and install the Swap 
Controller. 

3. Change line 10010 to PRINT CHR$(4) 
"BLOAD RWTS.XXXX, A$1900" (fill in 
the xxxx with the name you gave the 
RWTS file you BSAVEd earlier). 

4. RUN the program and follow the prompts. 

You can use the same RWTS for all the 
disks. When one is finished, just be sure to 
place your Super lOB disk back in the drive 
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before you type the RUN for the next disk so 
it can load the RWTS again. 

5. Finally use your Cqjy 11 Plus to change 
the boot program on all the disks to the 
first file in the list (for most of the pro- 
grams the file is caUed LOGO). Occa- 
sionally there will be a disk that already 
has a HELLO file. These can be left as 
they are. 

Softkey for... 

Terrapin Logo Language 

Terrapin, Inc. 

Requirements: 

original disk 

Super lOB with Swap Controller 

initialized disk 

Step-by-step 

1. Boot DOS (from your System Master or 
wherevCT) and INIT a slave disk with a 
binary hello name. 

POKE 40514,52 so DOS will BRUM the initial- 

hedfite 
INtrSDOS 
DELETE SDOS 

2. Capture the RWTS of the Terrapin Lan- 
guage disk using your favorite method 
and BSAVE it to your Super lOB disk. 

3.Remembertoretypeline lOOlOtoBLOAD 
the file you have just saved. 

4. RUN Super lOB and EXEC S WAP.CON 

5. Follow the prompts and copy the disk. 
(Answer "N" to the FORMAT THE 
BACKUP? question.) 

TTiat's it! Because of the nature of the 
program, adding a fast DOS doesn' t make a 
great deal of difference. The Utilities Disk 
that comes with the Language Disk isn't 
copy-protected. The monstrous manual is 
excellent! 

Softkey for... 

Tic Tac Show 

Advanced Ideas 

Requirements: 

COPYA (from the System Master disk) 
a sector editor (1 use Copy II Plus) 

Ihis is an excellent program that is akin 
to the television game ^ow Hollywood 
Squares. One or two players can play and 
X's or O's are earned on the board by 
correctly answering questions about a se- 
lected subject area. Data disks with the 
questions already prepred may bepurchased 
separately or (and here is the big plus for 
teachers) disks can be created on your own 
with your own subject areas and questions. 
This makes an excellent te^hing and re- 
view tool for any kind of factual material. 
Now for the "fix" to make the program truly 
valuable in the classroom (or wherever). 

Advanced Ideas uses three protection 
techniques on the d^k - tr^ks $00 to $ 1 are 
aU labelled track $00, secondly, address and 
data epilogues on all sectors from track $00 
to track $10 have been changed from DE 
AA to FF FF, and thirdly, there is a signature 
check on track %(B to keep you on your toes. 

Step-by-step 

1. Boot your DOS 3.3 System Master disk 
and run CX)PYA. 

RUN COPYA 

70 

Ctrl C at the first prompt 

POKE 47426,24 to igrwre epilogues 

POCE 48584,71 to ignore the track checker 

RUN 

2. Copy the whole disk (there should be no 
"grinds" cff other problems) 

3. M^e the following edits: 
Ids S2t fiyte bm Is. 

$00 $04 $CE FF DE 

^ $05 $84 FF DE 

$00 $05 $8E FF AA 

$09 $02 $07-09 BD89C0 606060 

Details 

Perhaps the most important rule of disk 
cracking is to do a careful analysis of the 
disk prior to attempting any copying proce- 
dure. I wish I could reaiember that rule a 



little betto^. Disks like this one certainly 
undersccMre the importance of the procedural 
bssics! 1 spentnearly two hoursof "spinning 
my tires" with this program. After settling 
down and going back to Square 1 , the whole 
thing was done 30 minutes later! 

The Nibble Editor of Copy II Plus uncov- 
ered thealtered epilogues. The Trax program 
in Bag of Tricks II highlighted the repetition 
of TrjKk $00 (as well as the altered epi- 
logues). After discovering these alterations, 
getting a copy using COPYA was easy. 
Then after making the sector edits from the 
FF FF back to DE AA in the appropriate 
places so DOS does not stumble while 
reading the disk, the loading "music" then 
gets an attentive ear. When you boot the disk 
at this point, you will hear the program begin 
to load, pause, then you get the scrambled 
scr^n and the reboot Both of these condi- 
tions are symptomatic of a signamre check. 

So load up your sector editor and scan for 
the 8C CO that is very likely some "distance" 
beyond DOS since we did hear some load- 
ing taking place after DOS was in place. 
Sureenough on track $(W tfieprogram checks 
for some E7's (C9 E7) after a disk read 
instruction. Further, the program returns 
(W) without any other spa;ial loading of the 
A or Y register. With that in mind, we may 
simply back up to where the program gives 
the instruction to turn on the disk drive to 
start this whole procedure (BD 89 CO) and 
tell it to return without bothering to do the 
check {m mm). And to and behold, the 
program not only runs, but does so much 
more quickly since it does not have this 
whole routine to go through before actually 
starting the game! 



kxAingat. 



l- 


JSR $A8F4 




1- 


JMP $71 9C 




J- 


JSR $9600 


«• The Protection 
Routine. 


-- 


BCC +25 





Marc Batchelor 
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Softkey for... 
Where in Time is Carmen Sandiego (//e) 

Broderbund 

I just received Computist #74 and wow 
am I dirappointed. I was hoping to have this 
crack in to Computist by issue 75. Even 
though the crack is already out (good job 
Brian and Terry), periiaps this may show 
that there is more than one way to skin a cat 
(or crack a ware). 

Sorry for the lateness, but we're caught 
up now so anything new will be printed in 
the current or next issue. RDEXed 

The Protection 

Where in Time is Carmen Sandiego 
(Time) has a rather annoying protection. 
That is to say, finding the protection is fairly 
time consuming, removing the protecticMi is 
simple, toting the product is a pain in the 
tush. The protection is not verified on star- 
tup, the disk is not perverted, the format is 
ProDOS and therefore hard drive compati- 
ble... it is... a key disk (oh no!). The only 
time that the protection shows up is when it 
is time to be promoted. At this time, the 
original disk needs to be inserted and veri- 
fied by the software. To get promoted, you 
must solve a case (not exacdy a piece of 
cake). 

Locating the Protection 

After playing the game for approximate- 
ly 35 minutes, I finally caught the thief 
(whew!), and received the "Put disk 'A' in 
the drive" message. At this point, I pushed 
the switth on my Senior Prom, pressed '5' 
(All Main to Aux), and then looked at where 
it was waiting. It had stoj^d somewhere in 
the AEAO page. Listing out the code here 
showed the following: 

AEA? LDA $C000 

BPL ■« 

BIT $C010 
RET 

Essentially, this routine continuously 
monitors the key latch ($C0OO) until akey is 
pressed, it then clears the strobe ($C010) 
and returns. Searching memory for refer- 
ences to this routine (via Senior Prom), 
turned up a reference at $7 IBE, $ A049 and 
$A09B. Listing at $71BE revealed: 

71BE- JSR $4DE9 

71C1- JSR $AEAO «- What we were just 



I discovered that typing 719CG turned 
on the disk drive, and then revealed the "Put 
Disk 'A' in the drive" message. Following 
further found the JSR to $9600. Which is the 
actual protection check. 

Where is it at? 

I searched side 'A' and side 'B' for the 
protection without success. I then started to 
break-out my 'EOR Scanner' and search for 
it when I decided to search the "data" disks. 
Low and behold, I found the JSR $9600 on 
side 'C',Track$lF,Sector$F,byte$9C and 
side 'D', Track $20, Sector $E. Byte $9C. 
Changing the JSR $96(X) to $18 EA EA 
worked like a champ. Extensive testing re- 
vealed that the pause for an original disk 
never shows up. This version can and has 
been played right up to acceptance into the 
hall of fame. 

Recap 

Searchside'C'&'D'for8C3544207D 
7C 20 00 96 and change the 20 00 96 to 18 
EA EA. That's it 

To Dave Grenda: (re: DOS 3.3 to Pro- 
DOS) Regarding your concerns about large 
DOS 3.3 programs receiving NO BUFF- 
ERS AVAILABLE message. This will oc- 
cur on files that have a starting address 
under $800. A great deal of single-load 
games have been cracked such that the code 
has been capttired from $800 and above, and 
at $7FD is a JMP to the "un-packing" rou- 
tine that places all of the code in the correct 
places. Regardless of size, ProDOS has an 
built in safety feature that prevents 
BLOADing a file with a starting address 
below $800. This would overwrite/destroy 
certain screen "holes" where important 
variables are stored. 

The fix 

This is not for the faint-hearted. First, 
verify the load address of the game by cata- 
Ic^ing it with COPY ] [+ "show file lengths" 
option. You should see a starting addr^s of 
$7FD (usually). If this is the case, boot a 
standard DOS 3.3 disk and BLOAD the file. 
Take <Mit a piece of paper and a pencil and be 
prepared to write. Enter the monitor. 
CALL-151 
7FD.802 

Write down the series of bytes that you 
see. Separate the first three from the second 
three. The first Oiree should be: 4C XX Y Y. 
This is the JuMP to the "un-packing" rou- 
tine. The next step is less straight forward 
and requires some machine language expe- 
rience. Disassemble the code with: 
YYXXL 

You are probably looking at the move 
routine that places everything in the correct 
places. If die code doesn't terminate with a 
JMP GGHH, type 'L' again. Keepdoing this 
until you have reached the end of the routine 
(indicated by a JMP GGHH). The GGHH is 
important as well so write it down. Now, 
assuming that you have space at the end of 
the move routine to add the following code, 
you can type the following: 
800:4CXXYY 

Then, at the end of the move routine, 
place the following pseudo-code. 
ADDR:A9 aa 80 00 08 A9 bb 80 01 08 A9 cc 80 02 

084CHHGG 

ADDR = address that the 4C HH GG was 
located on; aa is byte4 that you wrotedown; 
bb is byte 5 that you wrote down and cc is 
byte 6 that you wrote down. 

Assuming that you were able to follow 
the above instructions, this will solve your 
problems. 

To Kathi Quan: (re: Didatech pro- 
grams) In this issue (hopefully) I oudine and 
provide the crack for Fay: Word Hunter and 
Fay that math woman. I hope these help. 

Regarding your Pirates! problem, I expe- 
rienced similar problems (and worse ones) 



using Copy 11+ 9.0 on a Ilgs. I wrote Central 
Point software and they sent me a free up- 
date. ITie update fixes some of the^ prob- 
lems.but if I were you, I would use an earlier 
version until CPS gets some bugs worked 
out (Uke maybe a file compare routine that 
actually finds differences between files!?). 

Regarding the 'DS AA 96', 'DE AA'. 
and 'D5 AA AD' questions, here is a VERY 
brief explanation of the^ bytes: 

The 'D5 AA 96' are called Address 
Headers. These headers are the Disk Oper- 
ating Systems (DOSs) way of knowing when 
a sector on a disk begins. The 'D5 AA AD' 
are called Data Headers. These headers are 
the DOSs way of knowing when the actual 
sector data starts. The 'DE AA' are called 
address/data epilogs. These tell DOS that 
this is either the end of the data or the end of 
the address field. 

While this sounds cryptic, a fair analogy 
is that of a record. A record is composed of 
several songs. These songs are analogous to 
individual sectors on a disk. Preceding each 
song is a 'leader' or a 'pause'. This pause is 
analogous to the sector header. The sector 
header on a disk tells die operating system 
which track this is, and which sector it is — 
as well as a few other tid bits (tid bytes?). 
Anyway, to get to a particular M)ng on a 
r«;ord, die user must lift the record player 
arm, and place it on die header of die next 
song. 

The disk drive however reads the disk 
until it encounters the address headers 
(mentioned above). To the disk drive, diis is 
the same thing as the leader on a record. The 
disk drive then makes sure that this is the 
ccHTect track/sector (by reading the bytes 
after die address header), and if it is, reads 
the disk until it encounters the data headers. 
On a record, this is the 'end of the pause'. 
Once die data headers are read, the operat- 
ing system 'knows' that it is reading data. 
But it needs some way to 'know' when the 
data ends (the next pause). This is the pur- 
pose of the date epilogs. When theoperating 
system encounters these special markers, it 
'knows' that die last piece of data has been 
read. 

Mind you, the above is a condensed 
version of what actually happens, and it has 
its shorteomings. The autiioritative source 
for the full picture (and I dare say a better 
explanation) is Don Worth and Pieter 
Lechners marvelous publication Beneath 
Apple ProDOS. 

Back to the question presented howev- 
er... Software publishers really enjoy play- 
ing around with these special markers. So 
much so that it is UNCOMMON to purchase 
a commercial piece of software that does 
NOT have altaations in diese markers. The 
reason that changing these markers is so 
much 'fun' for them is because it is an easy 
first Step in deterring the novice from prying 
into their code. Since normal DOS is look- 
ing for 'D5 AA 96*, and a publisher changes 
their operating system to look for 'D4 AA 
95', a normal operating system cannot 
properly read (without modification) their 
disk. I hope diis has provided some insight 
into what someof the mumbo-jumbo means. 

To Steven T. Romanoski: (re: Sticky 
Bear Series) If it some consolation to you, I 
have cracked what I believe to be die entire 
series. If you are interested, send me your 
originals for about 2 days, and I'll send diem 
back with cracked copies. Please send a 
blank disk with each. My address was pub- 
lished in CcMnputist 73. 

Sierra On-Linegenerically used/uses two 
protections. One is a nibble count/signature 
check, and the odier is a code checksum 
routine that detects code alterations (if not 
performed correctly). 

Softkey for... 

MuppetVille 
The Muppet Word Book 
Memory Building Blocks 

Sunburst Communications 

The above three packages by Sunburst 
Software can be de-protected using ProDOS 
lOB, and a slight modification to the con- 
tioller. 
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1. Boot the software package. When the 
boot is complete, break into the monitor, 
and type in the memory move given in the 
ProDOS lOB article. 

2. Boot your ProDOS lOB disk, move the 
controller down in memory and save it 
(outlined in the article). 

3. Load in PRDS.IOB, and EXEC 
SWAP.PCON. 

4. Edit line 2010 and add: ':GOSUB 280' 
(ignores un-readable blocks). 

5 . Edit line 100 1 to read the correct name of 
the driver (saved in step 2). 

6. Run. 

7. When complete, copy a new ProDOS 
onto the disks. 

That's All there is to it. 

An closer look at the protection on 
Fay's Word Rally 

Preliminary Examination 

When I received this disk to crack from a 
good friend, my first impression was that it 
would be a cinch. Upon booting, it had a 
DOS prompt, it sounded normal, and reset 
could be pressed without the program re- 
booting. Using a fast copier yielded an error 
on track 2, sector 7, and the rest of the disk 
copied normally. Booting the copy resulted 
in a cleared screen and a DOS prompt after 
displaying the "Loading" message. 

In Depth Examination 

Since I religiously use Pronto DOS for as 
many programs as possible, my next step 
was to format a disk under Pronto DOS 
using POKE 405 14,52 (load binary "hello" 
program") and INIT DV (DV is the binary 
"hello" program). I then copied all files 
from the original to the formatted disk (don ' t 
forget side 2). Booting this copy landed me 
into the monitor at $BCE1. Since this is 
normally an un-allocated region (per Be- 
neath Apple DOS), I examined this area on 
the original disk (track 0, sector 6, byte El). 
What was stored here was an EOR routine 
used to decrypt the data stored at $6000. On 
track 0, sector 4 was a short routine to 
remove this code which is called after de- 
cryption. 

The binary file FWR is loaded by DV to 
$6000. Examining this file did show that it 
was encrypted, so I decrypted the file (using 
their routine) and re-saved it. Then , I needed 
to patch DV to jump into FWR instead of 
jumping to the decryption. After this was 
done, I booted my new copy. This had the 
sameresultas my fast copied version (cleared 
screen and a DOS prompt). 

My next step was to search the file FWR 
for BD 8C CO. No occurrences were locat- 
ed. The next step then was to trace the code 
(uggh!). Listing from $7893 (the entry point 
to the code), I traced until I found this 
beauty: 
85E8:A000 LDY #$00 Set up indirect Index to 

$5000 
85EA:8456 STY $56 
85EC:841B STY $1B 
85EE:A9 50 LDA #$50 
85F0:85 57 STA $57 58.57 = $5000 

85F2:A9BD LDA #$BD First part of BD 8C CO 

(Read disk). 
85F4:20B5 86 JSR $86B5 Store throughout $5000 

page via 56.57 
85F7:A98C LDA #$8C Second part of BD 8C 

CO (Read disl(). 
8SF9:20B5 86 JSR $86BS Store throughout $5000 

page via 56.57 
85FC:A9C0 LDA #$C0 Last part of BD 8C CO 

(Read dlsl<). 
85FE:20B5 86 JSR $86B5 Store throughout $5000 

page via 56.57 
8601:A98D LDA #$8D First part of 8D CO 50 

(Storage). 
8603:20 B5 86 JSR $86B5 Store throughout $5000 

page via 56.57 
8606:A9CO LDA #$C0 Second part of 8D CO 

50 (Storage). 
8608:18 CLC 

860g£51B ADC $1B 

860B:20B586 JSR $86B5 
860E:A950 LDA #$50 Final part of 8D CO 50 

(Storage). 



8610:20 6586 


JSR $8665 


8613:E61B 


INC $16 


8615-.A51B 


LDA $1B 


8617C91E 


CMP #$1E 


8619:90 D7 


6CC $85F2 


861B:A960 


LDA #$60 Store $60 (RTS) at end 




of check) 


861D:20B5 86 


JSR $8665 


8620:20 E3 03 


JSR $03E3 Find 106 


8623:84 CE 


STY $CE Store Location in CE.CF 


8625:85 CF 


STA $CF 


8627A902 


LOA #$02 Track 2 


8629i^004 


LDY #$04 Position in 106 for frack 




Number 


862B:91 CE 


STA ($CE),Y Use CE.CF indirectly to 




rebuild 106 


862D:A900 


LDA #$00 Command = SEEK 


862F:A0 0C 


LDY #$0C Position in 106 for 




COMMAND CODE 


8631 .-91 CE 


STA ($CE),Y 


8633:A003 


LDY #$03 Position in 106 for 




Volume ($00 = any) 


863531 CE 


STA ($CE),Y 


8637:20 E3 03 


JSR $03E3 


863A:20D9 03 


JSR $0309 Seek Drive to Track 2 


8630:60 27 


6CS $8666 


863F:6D89C0 


LDA $C089,X Turn On Drive 


8&42A930 


LDA #$30 Only do this $29 Times 


8644:8D78 05 


STA $0578 


8647:38 


SEC 


8M8.-CE7805 


DEC $0578 


8&4B:F019 


6EQ $8666 


8640:2044 69 


JSR $6944 Read Address Field 


8650:60 F5 


*BCS $8647 


8652A52D 


LDA $2D Sector Number 


8654:C9 01 


CMP #$01 Physical sector 1 (DOS 




Sector 7)? 


8656:00 EF 


6NE $8647 Nope... Try againi 


8658:BD8EC0 


LDA $C08E,X 


865B:A906 


LDA #$06 


865D:20A8FC 


JSR $FCA8 


8660:200050 


JSR $5000 Go mn funky Signature 




Check 


8663:18 


CLC 


8664:9004 


6CC $866A Always Taken 


8666A00D 


LDY #$00 


8668:61 CE 


LDA ($CE),Y 


866A:9D88C0 


STA $C088,X Shut Off Drive 


866D:A0 00 


LOY #$00 


866F;84 48 


STY $48 


8671:6038 


6CS $86AB 


8673:8456 


STY $56 


8675:A200 


LDX #$00 


At $5000 After 86E8-8620 is run. 


5000:60 8C CO 


LDA $C08C,X 


5003:80 CO 50 


STA $50C0 


5006:60 8C CO 


LDA $C08C,X 


5009:80 C1 50 


STA $50C1 


500C:BO 8C CO 


LDA $C08C,X 


500F:80C2 50 


STA $50C2 


501 2:60 8C CO 


LOA $C08C,X 


501 5:80 C3 50 


STA $50C3 


5018:6D8CC0 


LOA $C08C,X 


501 6:80 C4 50 


STA $50C4 


501E:eD8CC0 


LOA $C08C,X 


5021:8DC550 


STA $50C5 


5024:6D8CCO 


LDA $C08C,X 


5027:8DC650 


STA $50C6 



50A8:BD8CC0 LDA $C08C,X 

50Ae:8DDC50 STA $50DC 

50AE:6D8CCO LDA $C08C,X 

5061:80 0050 STA $50DD 

5064:60 RTS 

This software actually builds the signa- 
ture check on the fly. Notice however, that 
the signature check doesn't wait to make 
sure that it has read a valid disk byte — that 
is, there is no BPL following the read of the 
disk. This indicates a timing dependency to 
get the correct bytes read. 

The Fix 

To see the above code is easy... just boot 
the disk, and when the drive stops, press 
reset. Kidsoft did not think to clear the 
signature check (or the bytes following it) in 
the reset handler that they have. When reset 
is pressed, you will be placed in DOS (via 
$E000). At this point, we need to save the 
results of the check into a file (called NI). 
We just insert the copy, and BSAVE 
NLA$5000JL$E0. The only thing left is to 
patch the FWR program to BLOAD NI 
instead of performing the nibble count, and 
branch past the call to the nibble count. 



Soflkey for... 

Fay: That Math Woman 

Didatech Software 

Requirements: 

Fast DOS which de-allocates most of track 

2 
Fay: That Math Woman Original Disk 
File Copier 

Step-by-step 

1. Initialize a blank disk with Pronto DOS 
(or other DOS that de-allocates most of 
Track 2). 

POKE 40514,52 

INIT COPYRIGHT 1986 

DELETE C0PYRIGHT1 986 

2. Use a file copier to copy the files (There 
is only one side). 

3. Boot a DOS disk. 
BLOAD COPYRIGHT 1986 
CALL-151 

846:4C 05 67 remove decryption call 

AA60.AA61 file length in YY XX format 

UNLOCK COPYRIGHT 1986 
BSAVE COPYRIGHT 1986,A$802,L$XXYY 
LOCK COPYRIGHT 1986 

3. Load the encrypted FMWS program. 
BLOAD FMWS 

4. Type the following to decrypt the FMWS 
file: 

2000:A2 35 AO 03 A9 62 59 00 60 99 00 60 
200C:C8 DO F5 EE 08 20 EE OB 20 CA DO EC 00 
2000G 

5. Determine the length of the FMWS file 
and save it. 

AA60.AA61 length in YY XX format 

UNLOCK FMWS 

BSAVE FMWS,A$6000,L$XXYY 

6. Place the original in drive 1 , and type in 
the following to capture the signature 
check. 

889E:00N6705G 

7. Insert your copy and BSAVE the signa- 
ture check to side 1. 

BSAVE NI,A$5000,L$E0 
14. 

8. Patch FMWS to make it load the signature 
results. Save the patched code. 

BLOAD FMWS 

8823:A2 00 BD 30 88 FO 74 20 ED FD E8 DO F5 

8830:84 C2 CC CF CI C4 AO CE C9 8D 00 

AA60.AA61 length in YY XX format 

BSAVE FMWS,A$6000,L$XXYY 

LOCK FMWS 

That's All for Fay: That Math Woman 

Softkey for... 

Fay's Word Rally 

Didatech Software 

Requirements: 

Fast DOS which de-allocates most of track 

2 
Fay's Word Rally Original Disk 
File Copier 

Step-by-step 

1. Initialize both sides of a blank disk with 
Pronto DOS (or other DOS that de-allo- 
cates the part of track 2 that is not used by 
DOS). 

POKE 40514,52 for binary hello 

INITDV 

DELETE DV 

2. Use a file copier to copy the files. (Don't 
forget to file copy side 2). 

3. Boot the FWR disk. 

4. When the drive stops, press RESET. 

5. Insert your copy and BSAVE the signa- 
ture check to side 1. 

BSAVE NI,A$5000,L$EO 

6. Boot a DOS disk. 

7. Insert your copy, side 1. 
BLOAD DV 

8. Patch to remove decryption call to DOS. 
CALL-151 

934:4C93 78 

9. Determine file length. 
AA60.AA61 

10. You will receive the length in YY XX 
format. 

UNLOCK DV 



BSAVE DV,A$802,L$XXYY 
LOCK DV 

11. Load the encrypted FWR. 
BLOAD FWR 

12. Type the following to decrypt the FWR 
file: 

2000:A2 35 AO 03 A9 53 59 00 60 99 00 60 
200C:C8 DO F5 EE 08 20 EE OB 20 CA DO EC 00 
2000G 

This disassembles to: 

2000:A235 LDX #$35 

2002:A003 LDY #$03 

2004:A953 LOA #$53 

2006:59 00 60 EOR $6000,Y 

2009:990060 STA $6000,Y 

200C:C8 INY 

2000:00 F5 6NE $2004 

200F:EE08 20 INC $2008 

2012:EE06 20 INC $2006 

2015:CA DEX 

2016:00 EC 6NE $2004 

2018:00 eRK 

13. Make the following patches to FWR to 
load the signature results. 

85E8:A2 00 BD F8 85 FO 74 20 ED FD E8 DO F5 
85F5:00 00 84 C2 CC CF CI C4 AO CE C9 8D 00 
8660:EA EA EA 

This disassembles to: 

85E8A200 LDX #$00 

85EA:6DF8 85 LDA $85F8,X 

85ED:F074 6E0 $8663 

85EF:20 ED FD JSR $FDEO 

85F2:E8 INX 

85F3:D0F5 6NE $85EA 

85F5:00 6RK 

85F6:00 6RK 

85F7:00 BRK 

85F8:"'*DBLOAD NI'M" 

14. Determine Length of FWR file. 
AA60.AA61 

15. You will receive the length in YY XX 
format. 

UNLOCK FWR 

BSAVE FWR,A$6000,L$XXYY 

LOCK FWR 

That is all for Fay's Word Rally. 



Alan Chanev 
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Softkey for... 

Star RankBoxing II 

Gamestar 

Requirements: 

1 side of a blank disk 

copy program that ignores errors 

sector editor 

I copied the original program using copy 
2+ fast copy. Upon booting the copied pro- 
gram I was greeted with (PLEASE PUT 
ORIGINAL DISK IN DRIVE). I then 
searched the disk for the PLEASE part of the 
message, and found it in 2 places both on 
track one in sectors 5 and 8. 1 noticed that 
there was a DO 01 that branched pass a 
RETURN (60) and seem to run the PLEASE 
part of the message. SoItriedNopingoutthe 
above branch and you guessed it. 

1 . Copy the disk. 

2. Search for A5 FF DO 1 60 2C and change 
DO 01 to E A EA. You should find it twice. 

3. Write the changes back to disk. (Copy 
only.) 

Softkey for... 

Ikari Warriors II (Victory Road) 

Data East 

Requirements: 

copy program that ignores errors 
sector edit 

I search my issues for a softkey to this 
program and found 2, one by Mr. Moolenaar 
issue #52, and one by Mr. Simon in issue 
#53, but both were for Ikari Warriors and not 
part II of the program. 

So I copied the program (both sides) and 
booted the copy. Almost instantly the pro- 
gram rebooted again and again even before 
a program screen showed up. So out came 
issue #68 and Mr. Karwoski's crack bible 
forreferences. After readingpage29aminute 
or two, I tried looking on the disk for the 
reboot code of 4C 00 C6. 1 found the code on 
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the disk and Noped it out Altogether now, I 
can't be this smart or can I? 

1 . Copy both sides of the disk. 

2. Search for FO 03 4C 00 C6 A9 60 and 
change the 4C 00 C6 to EA EA EA. 

Put Carmen (USA) on a 3^" disk 

Requirements: 

The deprotected 5.25" program. 

one inited 3.5" disk 

A program to sector edit with. 

1. Name the 3.5" disk anything but 
Carmen.USA. 

2. Create 2 subdirectories, one to be for side 
B and one to be for side C (both directories 
should each come off of your Volume 
name. For example: 

/ANYTHING 
ANYTHING ->->-> ACABMEN.USA.S2 
->->-> ACARMEN.USA.S3 

3 . Copy all files except ProDOS from side A 
to your Volume name set in 1. 

4. Copy all files from side B to sub 
ACARMEN.USA.S2 

5. Copy all files from side C to sub 
ACARMEN.USA.S3 

6. Copy a clean ProDOS to the Volume 
section of disk. 

7. Search disk for "/CARMEN.USA." (last 
period is a must). 

8. We are going to make the Volume look for 
"ACARMEN" instead of "/CARMEN". 

9. Change 2For "/" to41 or "A" (4 Changes 
only), (NOT block 29). 

10. Search disk for lower case "/ 
carmen.usa.". Same changes (2 changes 
only). 

1 1 . There should have been 4 "/C" and 2 "/ 
c" changes for a total of 6 changes. 

12. Rename Volume to "CARMEN.USA". 

Time for you to go to work! Note: Hope 
this wasn't that hard to follow, because 
when Mr. Egnotovich of issue #72 per- 
formed the same thing it was simple enough 
for even the Wildman. Any questions? Call 
aCAB! Justjoldng. 

Softkey for... 
Where in Time is Carmen Sandiego? (GS) 

Broderbund 
Requirements: 

One 3.5" disk 

Fast copier 

sector editor 

Issue #72, Page 30 (by Mr. Hodge) 

The sector patch for Where in the USA 
(GS) also works for Where in time (GS). 
Just scan for the bytes to be changed. The 
article appeared in issue #72 (pg 30) and it 
was sent in by Mr. Hodge. 

On my disk the edit 8D to 60 is found 
easier by looking for AO CO 8D 24 9A on 
block 3 IF at byte 189. The big sector edit 
was on block 320 starting at byte IF. 

Note: In the big sector edit EB was E8 on 
my disk. 

I hope I don't get sued for Plagiarism, 
because my ship is stuck in the Persian gulf 
until further notice. 

Here is the patch by Mr. Hodge of issue 



#72 

filk Byifi ftam la 

$D7 $1DE A232AO0O A248A01E 

AD EE C0 10 A99F8FDF 

FBC9D5F0 4300A920 

06EBD0F4 8FE14300 

C8D0F1AD A9 76 48 28 

EEC010FB A9001860 

$148 8D 60 

Put Carmen (Time) on a 3^" disk 

Requirements: 

One 3.5" disk 
Sector Editor 
Original program disks 

The Times disk has a file that will auto- 
matically copy the program to a Hard Drive, 
Ram disk, or 3.5" disk, the file if I can still 
remember is "IN". But the copy continues to 
ask for the original program every time you 
advance to other floors (which is a promo- 



tion in rank). So I decided to make the 
program truly hard drive compatible even 
though I don't own such a luxury. 

The protection is in file MP. Scan the 
disk for 7D 7C 20 00 96 90 25 and change 20 
to AD now the copy will promote you to the 
next floor without the original. I think I got 
it? 

Note: The byte change also works on the 
5.25" copies. Scan disk "C" for the string. 
(Should I smile? Not yet!). 



can't find these bytes on your disk, you will 
have to consult a back issue for your partic- 
ular disk's softicey. 

Step-by-step 

1 . Copy disk with any program that ignores 
errors. 

2. Scan disk for 60 A2 00 AO 00 and change 
A2 to 60. 

3. Scan disk for the following 8 bytes that 
apply to the disk that you may have. These 




Advanced Playing Technique for... 
Arkanoid 11: Revenge of Doh GS 

Taito 

Requirements: 

Deprotected 3.5" copy of program. 

Unlimited men 

03/0425:DE E3 OF to EA EA EA. . 

Make these changes in the Monitor. 
O3/0FE3:03 # of Men Player 1 . 
03/0FE5:03 # of Men Player 2. 
03/1227 Highest score shown on 

screen. 
03/A754 Where 5 high scores are 

kept. 
00/1 BO A:0 1 Level for present player. 
00/1B28:01 Level for Player 1 . 
00/lB2A:01 Level for Player 2. 
00/1B76-1B79 present score player 1. 
00/1B7A-1B7D present score player 2. 

My subscription began at issue #69. You 
might think that there need to be more in the 
area of explanations, But this is all I have at 
this moment. Maybe after I get a few more 
issues under my skull cap, the articles will 
become a little easier to understand. Thanks 
goes to Computist and the many others that 
helped me to this point. 

Softkey for... 

Studymate (The grade booster) 
Compu-Teach 

Requirements: 

Two 3.5" disk 
3.5" Fast copier 
3.5" Sector Editor 

Copy both disks. The protection is on 
disk 1 . The protection is a key word found in 
the manual. The program gives you the 
page, paragraph and the number of words to 
count to on that line. After typing in the word 
and pressing return the program starts. 1 
tried with no luck to ehminate the check 
altogether. But I was able to make the pro- 
gram look in the same place every time for 
the key word to start the program. 

Scan the disk for 20 22 FC 20 IB FD and 
change to EA EA EA EA EA EA. Now the 
program will always ask for 36, 1, 4 which 
is METHODS. 

Help with Stickybears Disk 
(Optimum Resources) 
Requirements: 

Copy program that ignores errors. 

Sector Editor 

(maybe issue # 68 if you have problems) 

This help is being brought to you in part 
by the fine article written by Ralph Supinski 
in Computist #68. 1 think that the particular 
area on a disk where a protection is located 
is important to some, but not all of us. This 
help will be in the form of scans for bytes, 
instead of track and sector locations. If you 



bytes are found at the beginning of the 
sector in most cases .but not in all cases. 
Once you find the string, copy that whole 
sector to sector $0F on track $01. 

Mathl 

CAD0F3 88D0F018 60 

Math 2 

10 07 18 AO 05 71 75 AO 

Farts of Speech 

9175AAA001B175 10 

Reading 

9B ID 5F 32 56 AO AD 56 

Word Problems 

A9 00 65 97 48 8A 48 60 - 

Typing 

53 68 29F0 4A4A4A4A 

Town Builder 

C8 844D4C0E09 85 5F 

Math Word Problems 

85 97A0 01B196F006 

Spellgrabber 

5E29 20F0 04 8D55C0 

Reading Comprehension 

000000 0000 000000 

Volcabulary Development 

07 07 07 07 07 07 07 07 

Spelling Rules 

07 07 07 07 07 07 07 07 

Sentence Fun 3.5 

My copy not protected 

Spelling Rules 3.5 

BO 03 4C 00 00 Change BO to 80. 

Hope these quick keys helped someone? 



(I still don't have it yet.) 



Softkey for... 



Qix 
Taito 



Requirements: 

One blank 3.5" disk 
Fast copy program 
Sector Editor 

The Softkey I am about to give is actually 
Mr. Brian A. Troha's softkey of issue #73 
pages 14and 15. All I've done was to add 02 
in the place of his 08. His article even told 
me how to find the 02 and where to put the 
number in the softkey. The man's a wizard. 
For further details see his masterpiece. 

1 . Copy original disk and make these edits to 
the copy. 

Elk S^ Bsm l2 

4D5 77 22 730200 AF 73 02 00 



81 22A30200 AFA30200 

AC 22B60200 AFB60200 

80 9009 8009 

584 DC 0C070309 04040400 

2. Write changes onto your disk copy. 

I am glad tobeapartof this Organization. 
Am I a part yet? 

Note on The Legend of Blacksilver 

(Epyx) 

As of this writing, I have yet to find a 
protection on this disk. But I was kind of like 
hoping that a protection was there just to see 
if the first break was the start of some thing 
big?. I guess I have to buy another piece of 
software to woric on. Don't get the wrong 
idea, I did play this game for an hour or so, 
and during that time the disk worked per- 
fectly fine. 

Advanced Playing Technique for... 
QixGS 

Taito 

Unlimited Men 

Search your deprotected copy for DE 33 
09 and change to EA EA EA. 

Locations and changes 

These are the edits you must make from 
the Monitor. Some could be on the disk, but 
some I know are not. All of these changes 
are in bank $04. 

addr change toAeason or function 

1A0C:03 to 04, eliminates Sparx's from 

screen. 
0949:01 to #, multiplies score that # of 

times for Player 1 (max 6E) 

than return to 01. 
099B:01 to #, Player 2's timer. 
093D-0940 Player 1 's totals so far. 
441C-441F Player I's totals so far. 
0941-0944 Player 2's totals so far. 
4420-4423 Player 2's totals so far. 
3E26-3E29 Score of player now playing. 
092B:01 Location of threst % Player 1 
092D:0 1 Location of threst % player 2 

Threst % is controlled by the # in the 
above locations. Thenumbersare 1-4=65%, 
5-6=70%, 7=75%, 8-FF=80%. To keep threst 
at a constant % change 3A75:FE 2B 09 to 
EAEAEA. 

092F:01 
0931:01 
0933:03 
0935:03 
4B13 



Levels Player 1. 

Levels Player 2. 

Holds # of men for Player 1. 

Holds # of men for player 2. 

Location where 5 high scores 

are kept for score board. (# are 

read backwards). 



Instant points 

These2 changes will allow any size block 
made on the bottom or base line to score 
99% instantly. (Be careful not to get caught 
on the broken line part of block or it could 
get real ugly. (These addresses are in bank 
$03.) 

80FC:80 0C toEAEA 
8103:80 OA toEAEA 



Steve Kalvnuik 



Canada 



Playing Tip for... 
Wizardry V: Heart of the Maelstrom 
Sir Tech 

Level 1 

Ye castle teleport (12E,4N) Use bag of 
tokens. 

Bag of tokens (4E,4N) Fight for it. 

Temple of Brotherhood (8E,17N) Need 
to carry Orb of Llylgamyn. 

Orb of Llylgamyn (18E,9N) 

Silver Door (5E,27N) Use Silver Key to 
open. 

Silver Key (27E,14N) Inspect hidden 
items. 

Brass Key, Buy from Iron Nose in area 
behind riddle secret door. 

Riddle (20E,27N) Answer Vampire. 

Laughing kettle (22E,30N) Pay 100,500, 
1000, 2500, or 5000 for info. 

Conveyor control (6E,4N) Press 'D B C 
A' to shut off. 

Siairs toareaof Den of Thieves (15E,9N). 
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When shut conveyor off, cast Litofeit, 
secret door (12E,1N). 
Secret door (20E,6S). 

Level 2 

Ruby Warlock (7W,3N) Give bottle of 
rum to pass. 

Bottle of rum (3W,14S) Search crate. 

Jewel encrusted chest (4E,0N) Use spir- 
it-away potion to get Jeweled Scepter. 

Door sealed with heavy chains (2E,15S) 
Use hacksaw. 

Hacksaw (4E,3N) Inspect hidden items. 

Randolfs Mixture Emporium (8E,0N) 
Mix 'C A F' Get spirit-away potion. 

Le Dragon Flagon Bar (13E,9N). 

Bubba's Health Spa (9E,10N). 

Duck of Sparks near Bubba's Health 
Spa, Give rubber duck, get munke wand. 

Elevator to levels 2,3,4, and 5 (7E,4S). 

Level 3 

QuietpoU of liquid gold (26E,14S) Swim 
with no gold to level G, You will get gold 
and the gold key. 

Wall of deepest blue (12E,25S) Use blue 
candle. 

Grotesque figure overlooking fountain 
(2W,14S) Swim to level H, get petrified 
demon. 

Temple of Kama Kazi (12E,5N) Fight 
Lord Heinmitey, then use Jeweled Staff to 
open door. 

Timeless room (17E,8N) Inspect hidden 
items, use battery, press 'D E G C get 
pocketwatch. 

Blue Candle (12E,8N). 

Mad stomper on level 3, buy from him 
the rubber duck. 

Level 4 

Foggy pool with sexy lady (9E,9S) Swim 
to level J, get skeleton key. 

Old trunk marked D.H. (1 1E,7S) Inspect 
hidden items, get battery. 

Nymphette sitting on chest (11E,16S) 
Fight, get jack of spades. 

Face of demon on wall (6E,17S) Use 
petrified demon. 

Den of Thieves (10E,0N). 

Totem of many faces (1W,24S) Answer: 
time. 

Massive door with ivory skull (4E,24S) 
Use skeleton key. 

R.I.P. the loon (2E,24S) Use pocket- 
watch. 

The loon buy bird in cage. 

Ye gold vault (15W,21S) Use gold key. 

Black circle on floor touch the following: 
11W,33S/9W,31S/17W,34S/17W,28S/ 
12W,28S / 8W,25S / 16W,30S 

Black circle on floor do not touch the 
following: 9W,34S / 13W,28S / 
12W,25S 

Box with two statues (8W,21S) 
Search, fight, enter portal to hall of 
mirrors. 

Level 5 

Big Max (7E,1S) Buy tickets, give 
tickets or ticket stubs. 

Playhouse theatre: Warning do not 
enter as no spells work here. 

Secret door (6E,8S). 

Secret door (9E,6N). 

Secret door (2E,4S). 

Poolof blue water (20W,1S) Swim 
or lower a character to level C and 
will bring to life, cure, and heal even 
a lost character. 

Secret door (1W,15S). 

Secret door (5E,15S). 

The snatch (5E,12S) Give gold, learn 
about loon's locket. 

Level 6 

Dark well (8W,9S) Swim to level N, get 
queen of hearts. 

Evil eyes near (1 1W,2S) Try to steal gold 
medallion. 

Ice key (0E,2S) Inspect hidden items. 

Strange contraption (Ferry to Ice Castle) 
(7E,18S) Press 'G D A F E B C* to fix. 

Secret door (7E,17S). 

Ice Castle temple (8E,25S) Must use ice 
ferry to get here, get king of diamonds. 

Strange hole (5E,25S) Use ice key. 

Beware of quicksand at (14E,11S) and 



(12E,9S) Cast Litofeit. 

Frosted glass cylinder (14E,5S) Use gold 
medalUon. 

Level? 

Deep pool of midnight blue (10E,12N) 
Swim to level P, get staff of water, level o 
will bring the dead to hfe. 

Large sparks arc (13E,4S) Need light- 
ning rod. 

Staff of fire (13E,9S). 

Brass monkeys (0E,13S) Need munke 
wand. 

Lord of Clubs - White Knight (5E,6S) 
Ask time, nature, kingdom. Give ace of 
clubs to pass. 

Lord of Hearts - Blue Knight (5E,5N) 
Ask time, nature, kingdom. Give queen of 
hearts to pass. 

Lord of Spades - Red Knight (6W,5N) 
Ask time, nature, kingdom. Give jack of 
spades to pass. 

Lord of Diamonds - Yellow Knight 
{6W,6S) Ask time, nature, kingdom. Give 
king of diamonds to pass. 

Howling wind (13W,0N) Need lark in 
cage to pass. 

Speckled bird (12W,7S) Answer: life, 
get staff of air. 

Staff of Earth (5W,13S). 

In the middle of level 7 are four flames, 
for the color of knight you gave the card to, 
use Orb of Llylgamyn. 

Level 8 

Fight clones of self at (6W,0N) (0E,6N) 
(€E,ON) (0E,6S). 

At (4W,0N) use Staff of Earth, press 'A 
Dr. Answer is from one of the Lords of 
Cards. 

At (4E,0N) use Staff of Fire, press *C F 
G'. Answer is from one of the Lords of 
Cards. 

At (0E,4S) use Staff of Water, press 'B E 
H'. Answer is from one of the Lords of 
Cards. 

At (0E,4N) use Staff of Air. 

The rest is up to you, for you yourself 
have to understand, in order to become the 
'Guardian's of this mortal plane'. 

May the love of Abriel go with you. 

One final note: Be wary of the 'Netherde- 
mon' and 'Archdevil' in the level known as 
Hades. 

Please write if you have any more ques- 
tions. 

<f) Please would somebody contact me if 
they have or know about copies of 'Wizards 
Workbench' 'Wizards Workbench IF or 
' Wizi-Scout' by Magicsoft. These are Wiz- 
ardry scenario aides, and scenario creators. 
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Zork Quest 

From 
BC 

Gamma Force 
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60 



Irk Set gytg From l2 

$03 $0E $26 BC 60 

3. Write the change back to the disk. 
E.N. Hondrick 
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Roland Boucher 
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Softkey for... 

Gamma Force 

Zork Quest 

Infocom 

The copy protection routine in both these 
programs resides in Track $03, Sector $0E 
and I suspect that it is used in the other 
Infocomics. Search for the sequence: BC 8C 
CO 10 FB CO FF and change the BC to 60. 

Step-by-step 

1. Copy both sides of the disk with any 
normal copy program. 

2. Make the following sector edits to the 
boot side of the copy you have made: 



To Bob Igo: (issue #73, pl9) — Copy 
11+ does block read/write on both 3.5" and 
5.25" discs, of course, and so does ProSEL's 
BLOCK WARDEN and several others. 
There's a stand-alone ProDOS block editor 
in issue #55, pl4 or you can even decode 
blocks to Track/Sector numbers, using a 
table in the same issue as your letter, pU. 
Then too, doesn't Super JOB run under. 
ProDOS now? You probably know all this 
already, so what am 1 missing? — if it's the 
abiUty to read sectors with queer headers, 
then I hope you find out how and tell the rest 
of us, because I can't see how it's done 
either. 

Your question (issue #65, pl8) about 
keyboard bounce may be discussed in Jim 
Sather's "Understanding Your He", but it's 
out of print and I can't get a copy — sorry. 
Try spraying around the key with WD-40. 

To Groucho Tarz (issue #73, pl9)— the 
modifications in Computist #71, pl4 and 
#66, p21 sound good. Also change SF949 to 
a 1 or 2 to make a narrower listing and insert 
a JSR around $F8D0 to a patch that shows 
the ASCII equivalents during disassembly. 
Include a NMI or redirect the RESET vector 
from $3F2-3F4 , quit "blotting out" two bytes 
per sector, and have the auto-repeat function 
use a shorter "wait" value or one stored 
somewhere in RAM; pick a by te that' s load- 
ed with ProDOS. Fix RESET so it doesn't 
kill all your variables! You might want to 
keep the TAPE routines so you can use 
"AppleEar" or a Cauzin Strip, but I would 
get rid of those useless mouse icons and 
restore inverse/flash characters or use the 
space to provide a XFER.BOOT or some 
memory-save function for pages 0-7. You 
may want to fix INPUT to accept commas 
and colons and make other changes, but 
think twice; most of these improvements 
will prove useless unless you're writing 
programs for exclusive use on the one ma- 
chine. 

To Randy Flood (issue #73, pl8) and 
J.P. Mulder (issue #72, plO)— get the 
highest baud-rate modem available; you can 
set it to any lower rate you wish. Make it an 
external modem (you never know when you 
might decide to buy a new computer! ) 
and get a communications program 
you're comfortable with that handles 
standard AT format: ProTerm is as 
good as any and better than most. 

To Randy, Zorro (issue #72, p 1 7) 
and Gary M. Thorpe (issue #67, 
pi 2) — the method described by 
Groucho Tarz (issue #73, pl9) has 
been mentioned before in a very early 
Computist and elsewhere. If you only 
want a NMI card, your favorite mag- 
azine had some Integer cards for sale 
or I can probably buy you one here for 
the same terms plus a dollar to dis- 
courage competition; include S&H of 
$1.25 for 3rd class, $1.75 for 1st. If 
you just want to copy memory, you can use 
XFER.BOOT (re. issue #16, #25, and #58) 
or a commercial card (6 are listed in issue 
#73) such as Snapshot, Crackshot, Wildcard 
(all three reviewed in issue #1), Alaska 
Card, Instant Replay, Copy Master, or 
Sr.Prom (perhaps James Heil, 3809 Cynthia 
Dr., Pittsburgh, PA 15227, still has one for 
sale or Mr. Beard didn't grab the one men- 
tioned in issue #64). (I'm unfamiliar with 
Sr.Prom, Alaska, or Snapshot; the others are 
sometimes incompatible with various other 
cards and require extensive editing of the 
"captured" program to remove useless 
files — the entire memory is dumped, re- 
member — and they don't work if the pro- 
gram accesses the disc again.) 

The best deal of all, however, is "None of 



the above!" Jim Sather described how to 
create a "DOS HOSS" that loads DOS 3.3 
from an Integer card in Understanding your 
Apple He, then developed it into a multiple 
program device called the QuikLoader, 
which is sold through the Southern Califor- 
nia Research Group (SCRG, P.O. Box 593- 
R, Moorpark, CA 93020, 805-529-2082 or 
800-736-1484, $179.50; a burner's another 
$149.50 — have a Computist volunteer do 
it!). Theprice seems — formidable? — ^butit's 
still "worth it" if you use any program(s) 
repeatedly; it's much like taking that plunge 
when you buy a hard drive. You could have 
"instant-on" programs by using battery- 
backup RAM cards, but it'd cost twice as 
much (Memory+ doesn't list a Q-card any- 
more, so it'd be $340 for an RGB with 
Piggyback) and you don't get the other 
QuikLoader benefits: you press Z-RESET 
for DOS 3 .3 , Apple-RESET to use the disc ' s 
DOS, M-RESET to drop into Monitor then 
return to your program, or Q-RESET to 
select another program. They don't sell pro- 
grams already "burned" anymore — the pro- 
cedure's much easier than when I got mine 
so it's unnecessary — but they have ProDOS 
1.1.1 ready to transfer from disc to an 
EPROM and they expect 1 .8 "any day" from 
a third party. There are half a dozen sockets 
for EPROMs and you can mix 27064's with 
27512's if you like, but Applcworks 3.0 
alone uses three 27512's, they say, so plan 
on a few favorites. Better hurry, though; 
they deal only in Apple products and I 
haven't seen them mentioned in the ads 
lately! 

To Zorro (issue #73, p 1 5) — read the title 
page the next time you boot FrEd Writer; it 
is NOT public domain, but rather Free- 
ware — you can circulate it "to other teach- 
ers" but you can't sell it. There are no 
restrictions on "public domain" — you can 
even claim it's your own if you're unscru- 
pulous and think no one will notice — but 
technically (not likely, since they're pretty 
good guys) they could start charging for it at 
any time or even prosecute you for misrep- 
resenting their product. (I'd never want any 
of my work listed that way; as Brian A. 
Troha (issue #71, p6) says, "Credit is my 
payment and nobody likes to get ripped 
off!") The last member of this trio is 
Shareware, which is usually accompanied 
by a message to "send me $25 if you decide 
to keep it" when you download it from a 
BBS; Glen Bredon used to market ProSEL 
this way until it became well known. And do 
you still wan t to buy a burner (no DOCs) for, 
say, $70? It can be rewired (1 connection) to 
bum 27128's, but I want to go for 27512's. 

To Bill Jetzer (issue #72, p28) No, the 
gameport's capacitor-discharge method is 
too slow for analog-to-digital conversion 
from a tape. By the way, your DOS 3.3 
Enhancements look splendid, but 1 need the 
same information for ProDOS; I agree with 
Jeff Root (issue #72, pl2) that (except for 
game protection) "DOS 3.3 is dead!" 

To Stephen M. Caraco (issue #71, 
pl3) — I don't have a Ilgs and have never 
submitted softkeys of the very few discs I 
have figured out because I forget what I 
changed, but I can tell HOW to pick the 
JSR's and JMP's to change: watch what the 
machine does from the moment the program 
starts ("boot code tracing"), and when it 
does something you don't like, you change 
it by trial and error until it behaves! Differ- 
ent people try different things — that's why 
there are so many softkeys — and sometimes 
you're lucky, while sometimes you have to 
rewrite the whole thing. Personally, I like 
putting a $60 (RTS) at the beginning of a 
suspect routine or changing SEC's to CLC's 
for starts, but the programmer usually diinks 
of that, so.. .. Be sure to check out the rest of 
the disc before patting yourself on the back; 
I've had friends inform me that some of my 
attempts didn't work after all. Learn ma- 
chine language (ML — 16-bit for the Ilgs) 
and expect to spend hours on your first 
attempts. You'll find explicit clues for the 
Ilgs in issue #7 1 , p6 and issue #68, p27, and 
elsewhere. 
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To Carl D. Purdy (issue #71, pl2)— I 
can't help you with poor Carmen — it could 
be timing or alignment of the drive, power 
supply, etc. or even an address check. As for 
your Wildcard copy, it doesn't matter how 
much room is available, but how much is 
used. First check the program length: Wild- 
card copies used to be limited to 64K. If 
you've changed it to ProDOS from DOS 
3.3, check also that MAXFILES isn't 
changed in the original; if so, try adding 
.SYSTEM to the name to load it instead of 
BASICS YSTEM or change it back to DOS 
3.3 so you can scrunch down to MAX- 
FILES 1 . Next check for incompatible cards 
by removing everything you can and hoping 
it's not one of your built-in LASER func- 
tions. Now see if it's checking to "protect" 
you from running on the wrong machine, 
possibly via the Machine ID# at $BE98, or 
BLOADing into a part of memory "protect- 
ed" under ProDOS. Finally, try using 
Wildcard in a different slot. (This problem is 
unlikely if you've been successful before, 
but there was once a similar problem with an 
ALS Z-80 card (CALL A.P.P.L.E., Nov 
'83) and "it couldn't hurt".) Your last alter- 
native is to deprotect the disc completely — 
and send in your softkey. 

To Dave Grenda (issue #72, pl5)— See 
notes to Purdy on lengths. 

To Ron Stankiewicz (issue #73, p5) — I 
can see five reasons for undocumented 
functions: (1) the author needed to access 
different parts of the game during develop- 
ment and didn ' t want to play the whole thing 
every time, (3) it may serve to authenticate 
authorship in a copyright litigation, (2) he 
wanted to take a break without rebooting (as 
in Sky Fox), (4) he tells only half his "beta- 
testers" about an alternative to see whether 
it improves the game or whether anyone 
discovers the feature on his own (as in S uper 
Mario), or (5) he has a warped sense of 
humor (like me) or just wants to give his 
customer a Uttle bonus (like the back of 
Printshop or Karateka). The undocumented 
feature in CAT.MAKER is mostly like (1); 
I used it during development and it probably 
won't help on a protected disc, but it's there 
to try if you want — just press (S)ave when 
asked for the ID-#. 

To The Executioner (issue #68, pl7)— 
What you want to do is save your words and 
definitions as a set of text files, probably by 
chapter of the text you're using, and recall 
them randomly. If the entries are short, use 
a random-access file and READ X$,R#, 
where R# is the word-number; otherwise, 
use a sequential file and load the whole list 
into matrices or a two-dimensional array. 
Place the number of entries at the beginning 
(in Record 0) or end each set with an easily 
identified symbol like "?". Separate the word 
and its definition with a dash (search each 
"string" for K$=" — ") or use commas and 
INPUT"";A$,B$. If this is too difficult (it 
really isn't, as I've done it myself), write 
again and I'll make you a program by next 
summer, but give more information on what 
it should do: print in lists, suggest multiple 
choices, give the definition and you supply 
the word instead, etc. 

To Duane E. Spencer (issue #67 , pl2) — 
Yes, I use a Laser 3.5 with a lie running 
underProDOS.If you want to store DOS 3.3 
on the 800K discs, you'll have to switch to 
AMDOS, UniDOS, etc. 

To Tim Valuk (issue #67, p20)— the 
program counter keeps track of which ad- 
dress your program will get its next instruc- 
tion from. You read it by encountering a 
"Break" (00) as the program runs or by 
pressing ctrl-E while you're in the monitor. 
Find out more in a book about Machine 
Language (ML) for the 6502 or 65C02 chip, 
such as 6502 Software Design by Leo J. 
Scanlon or a "SAM" selection at your local 
electronics store. 

To Leonard R. Simon (issue #65, p8) — 
it sounds to me as if you may have exceeded 
DOS's limit of 105 files/volume. You can 
open a "large volume" to give room for all 
those CON. files and take over some sectors 
for the volume directory (SubtleSolutions's 



"Hard Byte Editor", $29.95 + $3 S&H, 314 
S. Red Lion Terrace, Bear, DE 19701)— 
don't forget to mark them "used" in the 
VTOC — or simply continue on another vol- 
ume. Your best move would be to convert 
your Sider entirely to ProDOS (Advanced 
Tech Services, P.O. Box 9204 1 3 , Norcross, 
GA 30092, 404-441-3322, $59.95 + $2.50 
S&H) to get faster access and NO limit on 
the number of files in subdirectories grouped 
by subject or whatever. (The main directory 
is still hmited to 51, though.) You must tell 
them the model ("blue label, red LED" etc.) 
in order to get the proper chip, so call first. 
While you're at it, get ProSEL ($50, same 
source; there's no point in trying to contact 
Glen Bredon personally, it seems, as my 
friend and I have both written to him and 
never even received an acknowledgment) to 
manage the entire system — copying, lost 
file recovery, sorting directories (any way 
you like, not just alphabetically), etc. Once 
you're in ProDOS, you can open your direc- 
tories like text files and print them out, make 
catalog files, or whatever else you wanted. 

To John Windle (issue #65, p29) and 
Keith (issue #71, pl2)— using $F8D0 di- 
rectly places "F8D0" in $3A-B and is use- 
less, unless you like seeing $F8D0 disas- 
sembled every time! Follow the directions 
in the BLISTER "docs" instead. The usual 
way to print out this code is (1) CALL-151 
and S300LL etc. until you know which parts 
and how many L's (screens full) you want, 
(2) return to BASIC and turn on the printer, 
then (3) repeat step 1 . If you want to do it in 
a program, WRITE it to /RAM or print on 
the screen in a fixed location and pick it up 
as a variable by resetting the pointers as my 
BLISTER program does. (BLISTER should 
appear about the same issue as this letter.) 

To Gintana (issue #64 , p8) — the point is 
that ProDOS is faster, accesses more files 
(you can have a disc FULL of nothing but 
directories or catalogs if you want), has 
more commands, and keeps tfack of files 
better. The last point is the important one. 
The file names are laid out like a school 
"outline", so if you need a FILE 
RUNFILE,S6,D1 just like DOS 3.3 or if it's 
in a SUBDIRECTORY C'subheading" of 
the outline) that is found in a DIRECTORY 
on a disc named DISC, you type -/DISC/ 
DIRECTORYl/SUBDIRECTORY/FILE. 
(There's a way to abbreviate so you can just 
type -FILE, but this isn't a tutorial.) Also, 
you never notice it, but ProDOS uses a 
"Machine Language Interface" (MLI) so no 
matter how ProDOS is changed, the same 
information can always be found in the same 
place. You can BLOAD X in DOS 3.3 to 
find X' s address at AA72-3 and the length at 
AA60-1, but this overwrites whatever else 
you had in memory and it works only on 
binary files; in ProDOS , you could VERIFY 
X or even UNLOCK X to get the type, etc. 
into the MLI, then even if it's not a binary 
file you can BLOAD X wherever you want 
it, examine it, and write the changes back to 
disc — one byte at a time, if you Uke! 

It's not perfect — I hate the way it "pro- 
tects" you from BLOADing into the Key- 
board buffer at $200-FF, for instance — ^but 
ProDOS is REALLY improved and not just 
"New Improved" like a bar of soap or what- 
ever. It used to have one fault that kept me 
from accepting it for over a year, and that 
was its "Launching" system — how you start 
the machine. Booting DOS 3.3 without a 
HELLO program just drops you into BASIC 
with a "PROGRAM NOT FOUND"; Pro- 
DOS had an idiotic STARTUP (read "HEL- 
LO") that essentially said "Guess the disc 
and program names and I'll let you run it." 
Now you can get a Launch System like 
ProSEL, QUARK, SQUIRT, or BYRD'S 
BETTER BYE (incorporated into Apple- 
works 3.0) that does away with such non- 
sense; you won't notice any difference with 
ProDOS until you try to do something that 
DOS 3.3 wouldn't let you do anyway, like 
BLOADing a text file or running a program 
from a different disc by giving the name 
without slot/drive numbers. 

To Marc Batchelor (issue #72, plO)— 
When I was shopping for my first "person- 



al" computer in '82, an IBM salesman told 
me "You can't afford it" instead of giving 
me the price; what got me was the snob was 
right! I wouldn't trust anyone who makes 
decisions by the size of my wallet even if he 
were giving his machines away with prizes, 
so if a Tandy salesman told me his machine 
is just like IBM's and that MS-DOS is stored 
on a chip, do you suppose I bothered distin- 
guishing which one he was referring to? 
Besides, the TS-80 had a severe "keyboard 
bounce" problem; Atari had no bounce be- 
cause there was no keyboard; and Commo- 
dore had no utilities and a flimsy card to add 
four slots where there had only been one — 
so when I found a machine that INVITED 
me to explore with eight slots and a built-in 
Monitor, I made a commiunent. A couple of 
years later, IBM let their "PC Jr" die of 
neglect just about a month before I decided 
to buy one with a hard disc for litde more 
than a new Sider alone, and I knew I was 
with the "good guys." Sure, I "rag" on IBM, 
butit's just human nature, I suppose: when- 
ever it appears I made the right move I'm 
delighted (Ho, hum, IBM! Apple already 
has mice) and when it looks as if my huge 
investment will vaporize (Apple stuff is all 
sold through IBM outlets around here, you 
can't buy a Ilgs or Mac by mail order, and 
our only Apple dealer "wouldn't recom- 
mend" that I buy a He) I get a little paranoid. 

You seem to be comparing apples and 
bananas, or rather the top of one product- 
line with the bottom of the other. An 8-bit 
machine running at 33 Mhz, indeed! So 
what does either have to do with a "user- 
hateful environment"? I wouldn't expect 
that of either a 11+ or an XT, but flying at 
"speeds of 33 Mhz" and multi-tasking under 
UNIX sounds pretty normal for a Mac, if 
you ask me. And what is there to "imagine" 
about not using BRUN? — typing one extra 
"-" to EXEC/RUN/BRUN isn't really that 
onerous! Blame Microsoft if either version 
of BASIC is inferior, and blame the people 
who put together MS -DOS if they left out or 
included some distinctive feature. It's sur- 
prising that the PATH function wasn't in- 
cluded in ProDOS , but IBM and Apple both 
sell computers like cars; PATH is probably 
being saved for next year's model. Before 
you write your own, save yourself some 
trouble and check the public domain where 
IBM seems to get most of its stuff: it's 
ahnost certainly out there, along with all 
those languages you wanted. When you find 
it, you can make it the first .SYSTEM on the 
disc or tack it onto ProDOS, whichever you 
prefer. The important point is that NONE of 
this is intrinsic to the machine itself; what's 
"under the hood" is all the same, just as long 
as you're talking the same requirements, 
and much of the hardware and software 
came from NEITHER party— Atari had the 
original 6502 chip (via Motorola), Commo- 
dore had sprites and sound envelopes before 
the Ilgs, a "human-resources" group invent- 
ed the menu-style used in the Mac, etc. 

A 32-bit machine will always be faster 
than a 16-bit which is much faster than an 8- 
bit — if speed is what really matters, buy a 
Cray (designed on an Apple)! The only real 
difference between Apple and IBM is that 
Apple had slots and a Monitor and a friendly 
smile, while IBM had money and a lot of 
overconfidence, yet it's easy to see why 
Apple appealed to "the common man" — 
me. IBM had all those neat things years ago 
because there was nobody else to sell them 
to, notbecauseof their own creativity. (They 
created EBCDIC for their mainframes, but I 
think that was just an ornery attempt to make 
them incompatible with everything else.) 

Then Apple came along. 'Try your hand 
at programming! It's easy, here's a big red 
manual to help, and the slots are for things 
that haven't even been invented yet but you 
can install them yourself when they come!" 
Even Applesoft wasn't built in, just in case 
you needed that limited 4K for a special 
program. You can't play with a mainframe, 
but you can do whatever you like with a 
"cheap imitation", and third party develop- 
ers scared the bejeebers out of IBM with 
Visicalc, 80-coIumn displays, Appleworks, 
etc. and macte them enter the "home" market 



long before they were ready. 

Then Apple betrayed all of us! Now it 
costs $600/year to be a developer for Apple, 
and the earliest Macs had neither slots nor 
Monitor because the public "wasn't smart 
enough" to use them. The red manual that 
came with the II told you MORE than you 
wanted to know about the insides of the 
machine; the latest one compliments you on 
buying a machine widi cute pictures that's 
entirely menu-driven, can't be stopped to 
see what's happening, has no place (appar- 
ently) to access machine code, and barely 
matches the display of six other cheaper 
boxes — is it any wonder IBM no longer 
feels threatened? 

I've never seen a company bent on self- 
destruction before, but it looks as if my 
investment's in real trouble this time! Mac 's, 
Ilgs', He's, Ill's, Porta-Mac's, and who- 
knows-what-else can 'tpossibly outsell "buy 
this machine and it'scompatible with every- 
thing", especially when they can say "we 
have everything anyone else does plus a 
world-wide reputation for doing the work 
for you." Trying to sell one machine to 
elementary schools, another to high schools, 
and none at all to colleges (along with the 
idea that Apple is for "education") just to 
boost sales is pure madness! It perpetuates 
the notion that Apples are toys and can't be 
"serious". (Besides, I know only one person 
who even considered "education" when she 
purchased her machine, and then it was the 
reason for buyingnow instead of later; ithad 
no influence at all on the type.) 

I've played on a Mac, but even I wonder 
whether it's any better than an IBM with 
"Windows". There are people in business 
(and business teachers) who honestly be- 
lieve that only an "International Business 
Machine" can do the job and Apple is for 
play, yet Apple advertises how FUN it is to 
learn on a Mac and pretends the 11' s are 
made by a different company that doesn't 
advertise at all! It really pains me to admit 
that you're right, but the clones have every- 
thing an Apple has to offer. (I still refuse to 
say anything about IBM except they're 
overpriced.) 

I'm sorry for the poor wording (issue 
#69, p8) that upset you last year, and prob- 
ably again in this article too. Don't take any 
of this personally, as I really enjoy your 
articles (except when IBM comes up) and 
would miss them; I'm just negative because 
of Apple's horrible marketing "strategy". I 
suppose things aren'treally all that gloomy — 
just recently I heard of a club for Ill-owners 
(PC Jr counterparts) and the II's aren't that 
far gone yet. I'll try to think of something 
nice to say next year, okay? 



Dr Crack 



France 



Softkey for... 

Champions of Krynn. 

SSI 

This is I think the latest release from SSI 
of the AD&D series. It's the first volume of 
the Dragonlance series. This version No. 1 .0 
has only a few bugs, for example: in combat 
mode, one of the five dragon types is made 
up of four sprites but when he attacks only 
two out of four are up-dated so you end up 
looking at a pretty strange-looking dragon. 
It is a very good game anyway, with good 
graphics and a good quest. 

The four disks can be copied with a fast 
copier and can be sector edited. The copy 
protection consists of a documentation 
check: the game asks you for a word from 
the Adventurer's Journal (AJ). This is quite 
annoying after a while because you have to 
get the AJ, look up the entry and then count 
up to nine (!) words. 

After some time, I was so sick of it I 
decided to get rid of it, so I searched for one 
of the words in the Ust. After some searching 
I finally found it. Between each one was $00 
which had to be a separation between each 
word so if I wanted anything to be correct 
then I would have to put $00 everywhere. I 
tried that, and it worked. 

You may have noticed that you can insert 
any disk when the computer asks you for 
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disk A after you have chosen the 'begin 
adventuring' line, I did, so I searched every 
disk for the list and there it was, on every 
single disk. 

Once you have made the changes you can 
answer anything, even 'return' to the ques- 
tion. 



Ids aa E^ 

18 OE C6-F 
18 OD 



Boot disk 

?? 

OO-BE 
Disk A 



I2 

all to (X) 

?? all to 00 



m 

IB 



03 
IB 



Byte From 
C6-FF ?? 
02. OO-BE 

DiskB 



14 ^ a^g Emm 

19 OD C6-FF ?? 
19 OC OO-BE 



Trk Set Bvte 
1A 05 C6-FF 
1A 04 



Ids Ssa Bas 

1C 00 C6-FF 
1C OE 



M S2t SHte 
IB 02 C6-FF 
IB 01 



DiskC 

From 

?? 

OO-BE 

DiskD 

From 

?? 

OO-BE 

DiskE 

From 

?? 

OO-BE 

DiskF 



I2 
00 



I2 
00 



I2 
00 
79 



Is 

00 
7? 



I2 
00 

?? 



00 



00 



00 



00 



00 



Ids Ss! E^ From Isj 

1B 04 C6-FF ?? 00 

IB 03 OO-BE ?? 00 

® I have a question to ask all old Com- 
putist readers: Has anyone been able to 
crack Questron I? If not, has anybody been 
able to sector edit every track or sector? 

I think that your magazine is the best, it's 
the only one I'm going to keep subscribing 
to even though most of the stuff is now for 
Apple Ilgs. 



Rod O'Brien 



NY 



This is my first letter to Computist, even 
though I have been a subscriber for a few 
years now. I am only beginning to under- 
stand most of the procedures listed in the 
magazine but even when I don't understand 
the reasons for a crack I still benefit from the 
use of many of those printed. I guess my 
guilt finally got the better of me and I am 
sending in what infonnation I can to try and 
help some of those who have helped me. 

Playing Tip for... 

Dungeon Master 

FTL 

Dungeon Master Puzzles 

To George Bigelow (issue #73, re. play- 
ing tips for Dungeon Master). The third 
level has a puzzle called "Cast your influence, 
cast your might" which George could not 
figure out TTie answer to this puzzle is two 
part, first cast a spell of LO ZO to open the 
door, then have your strongest character 
throw an object into the next room, a club or 
stone will do. This trips the plate on the other 
side closing the pit. 

Another good thing to do is have your 
Ninja character as the active hand when 
moving through the maze. As you move 
from area to area throw things in front of 
you. This allows the Ninja to gain points and 
levels without fighting and it doesn't matter 
what is thrown, rocks old swords from de- 
feated enemies or even a shield. It all adds 
up. 

If you want the complete set of maps and 
game hints for Dungeon Master contact: 

Mullen Graphics 
518RoycroftAve. 
Long Beach. CA9(»14 

It is worth it just to not have to map out 
the dungeons. 



Softkey for... 

Dungeon Master 

FTL 

In Computist #70 there are two Softkeys 
for DM (page 12 and page 18) from Bob 
Thanski and Jim Ross. I used the Jim Ross 
softkey but the problem is that my copy of 
CopyII+ (v9.1) would only copy part of the 
tracks. 

When reading the original the program 
stops a little more than halfway (at track $34 
on mine) and then prompts the user to insert 
the duplicate disk. When writing to the new 
disk it then writes in garbage for the tracks 
above the stop point. This will cause more 
than one error to appear when verifying the 
disk and will not allow the program to run. 

The way around this problem is to follow 
Jim's softkey BUT to go back and then 
recopy the tracks from the stop point to the 
end of the disk again. Then follow the Block 
edit in the original softkey. This will get you 
a deprotected and workable copy. 

Step-by-step 

1 . Use the Manual Sector Copier function of 
Copy 11+ and ignore the error on Block 

$17. 

2. Make a note of where the programs stops 
reading the tracks and asks for the copy to 
be inserted. Write it down. 

3. Recopy tihe leftover parts to your copy 
from the stop point to the end of the disk. 
(Use the same copier program) 

4. Manual Bit copy Track with Sync = N 
and Keep = N 

5. Verify copy to insure there p only one 
error (on block $17) 

6. Sector edit block $104 (it was here that I 
found another difference in Jim Ross's 
Softkey). 

ail Ms. From la 

104 110 18 38 

113 38 18 

Each user should check for the correct 
bytes on their version of DM, mine w^ v2.0 
of the game. You now have a cracked copy 
to play from. i 

Problems with the softkey 

I have had the program freeze up and the 
screen go weird sometimes on the cracked 
version when I "save and play" the game. It 
does not affect your save so you can reboot 
and start from where you saved without a 
problem. The boot sequence is just so slow. 
A quick tip to avoid this problem is to "save 
and play" and then immediately throw an 
object cff cast a spell (one that can be seen 
moving on the screen such as a poison bolt 
etc.) and see if there is movement. Your 
characters will be able to move all the time 
but sometimes objects and spells will be 
suspended in the air never to land and that 
prevents the character firom ever being used 
again. The results: you will die sometime 
soon. If you experience this reboot the game 
and restore the game and you will find no 
problems. It just is a slow process. 

® Maybe someone out there knows why 
this happens and can come up with a fix. 
Also, does anyone know how to install DM 
on a hard drive? 

Copy 11+ (9.0) and hard drives (vi'ith 
GS/OS) 

I have been experiencing trouble with 
my Apple Ilgs and Copy 11+ (V9.0). It seems 
that this version has a bug in it that does not 
allow the GS to use GS/OS correctly. The 
shutdown sequence of GS/OS includes two 
messages, the first one asks if you want to 
really shut down etc. and then when you 
answer yes, it shows you the "you may 
safely shutoff your GS now" message. This 
allows GS/OS to close all its tolls etc. (I 
think). The problem with Copy 11+ (V9.0) is 
that when installed on your hard drive it 
does not allow GS/OS to shutdown proper- 
ly. This happened regardless of whether or 
not Copy 11+ was us6d during the session. 
When I removed it from my hard drive all 
problems with shutdown disappeared. A 
call to Central Point Software allowed me to 



inform of this problem (it appears to be a 
new one to them) and got me a new version 
of Copy 11+ ( V9. 1 ) and the problem seem s to 
be gone. I now have Copy 11+ (V9.1) on my 
hard drive and GS/OS works fine. Call for 
your FREE replacement if you are a regis- 
tered user. If you are not a registered user the 
manual alone is worth the cost of the pro- 
gram. 

Deluxepaint II — A patch for the 
ngs 

In Computist #74 (page 6) User #601 
asks about using Deluxe Paint with GS/OS 
V5.0.2. There is a patch available on line for 
this change and it comes from Jason Harper 
(who has programmed some great Public 
Domain and Shareware programs) that al- 
lows you to patch DP II. I'll reprint the patch 
heie for those readers who don't have mo- 
dems but still need the patch. 

This patch only works with DeluxePaint 
II version 2.0 (the program file has a modi- 
fication date of 30-Apr-87) or Version 2.01 
(22-May-87). 

Use a COPY only to try this patch. 

1. Boot into BASIC and at the prompt, "]" 

type, 
BLOADDELUXEPAINT,T$B3,A$300,L1,B$19C12 
PRINT PEEK (768) 

At this point a number (0 or a 1) will 
appear. If it is a zero proceed, if it is a one do 
not continue. The one means the p^ch has 
akeady been applied or it is a different 
version of the program 
POKE 768,1 
BSAVEDELUXEPAINT,T$B3,A$300,L1,B$19C12 

The patch is now applied. 

To Rex Creekmur (issue #72), there is 
an easy way to copy Micro League Baseball, 
use Copy 11+ (any version that lists the 
program,Ifoundit on version7.4)and that's 
all. 

If you don't have that version use these 
parameters to copy Micro League Baseball: 
Copy Track 0-22 and Keep 
the Sync 
T0-T22,sync 

©If anyone out there knows how to 
crack the Micro League Manager's Disk or 
Stat's Disk please let us know. 



Moimma 



CO 



Softkey for... 

Crosscountry USA 

Didatech Software 

Crosscountry USA is an excellent ge- 
ography program that has been around for 
several years. I have tried numerous ways to 
back it up and have had no success. B. 
Dudley Brett's crack for Crosscountry Can- 
ada (#71, p.16-17) finally unlocked this 
disk. The prota:tion is very similar, a matter 
of moving the protection a few bytes. For a 
more complete explanation, read his excel- 
lent article. 

Step-by-step 

1. Copy both sides with any copy program 
that ignores errors. 

2. Use a sector editor to make the following 
changes: 

Ids Ssl E^ From I2 

$00 $04 $92 4C 00 

3. Boot the disk you have created and wait 
for the '*'. Edit the hello file that is in 
memory. 

Addr Old value New value 

0892: DOEF EAEA 

OB30: C8 EA 

4. Then type: 
UNLOCK COPYRIGHT 1985 

BSAVE COPYRIGHT 1985, A$0805, L$373 
LOCK COPYRIGHT 1985 

Softkey for... 

MECC 3.5" Disks (1990) 

MECC 

MECC is now putting a lot of their pro- 
grams on 3.5" disks as well as 5.25". Some 
of the programs are deigned solely for the 



GS. Unfortunately they all are copy-protect- 
ed and the charge foe the copy disk is out- 
rageous. Anyone who has been in the class- 
room knows better than to put an original in 
the hands of students. After the last wait to 
get disks from the central office I decided to 
try to crack them. With thehelpof articlesby 
several fellow Computists (in particular 
Brian Troha's article in Computist #65,p.33- 
34) I found the protection and removed it 

The current MECC disks are eitter 128K 
compatible or are written for a 1 M GS. Each 
has a bad block, usually Block 7 or Block 8, 
and all the disks I tested deprotected in the 
same manner. In all cases you are changing 
a SEC 38 (which fails the carry check) to a 
CLC 18 (which clears the carry flag). 

To find the protection code, I first copied 
the disk with a copy program that ignored 
errors. Then I searched the copied disk for 
either $20 00 BF 80 (on the 128K ProDOS 
8 disks) or $22 A8 00 El 22 00 (on the GS/ 
OS 5.02 disks). The P8 disks all have the 
protection in the file MECC.SYSTEM. On 
those disks you should find ccxle that looks 
something like this: 

20 00BF JSR $BFOO 

80 read block 

1122 

BO 98 BOS $1174 

18 CLC 

60 RTS 

2CE5 21 BIT $21 E5 

0)91 BMI $1174 

38 SEC 

60 RTS 

The critical pattern to wateh for is the 
CLC/RTS and SEC/RTS combinations. You 
want to change die SEC to CLC. 

On GS/OS disks the code will look like 
this: 



read Wock 



22A800E1 


JSL $E100A8 


22 CX) 


1 


22A800E1 


JSL $E100A8 


2200 


1 


C927 


CMP #$27 


00 


BRK 


DO 02 


BNE $11 CT 


18 


CLC 


60 


RTS 


38 


SEC 


60 


RTS 



read block 



Same CLC/RTS, SEC/RTS pattern as 
before. Again the change will be to change 
the 38 to an 18. 

The following are the specific programs 
I tried and succeeded with: 

Time Navigator Leaps Back 

Bi Bxla Ecm la 

$28 $1DC 38 18 

Murphy's Minerals 

SI SySa £mi I2 

$28 $1F5 38 18 

Sun and Seasons 

$28 $1B5 38 18 



Fossil Hunters 

a te Earn I2 

$D6 $1DC 38 18 

Five-Star Forecast 

ii i^ froni I2 

$7 $1DC 38 18 

Spelling Puzzles & Tests 

SlJi i^ flora I2 

$57 $1A3 38 18 

Probability Lab 

ijk Byte £[oni Jo 

$28 $1DC 38 18 

Estimation: Quick Solve I 

EE Bytg EmL I2 

$28 $1DC 38 18 

Estimation: Quick Solve II 

ii Eyti Ersai I2 

$28 $1DC 38 18 
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Designer Puzzles 



fills, 

$42A 



fiE 



Byte 
$1CF 



From 
38 



Ifi 
18 



Designer Prints (1989) 



Bvte 
$CE 



From 
38 



I2 
18 



Mercury (1989) 



fills 

$B4 



Bvte 
$180 



From 
38 



I2 
18 



Softkey for.. 



Slide Shop (GS) 

Broderbund 

The protection on theGS version of Slide 
Shop was a bad block check on block 1599. 
I used the search for 20 00 BF 80 as suggest- 
ed by Brian Troha and found it on Track S2B 
(43). There were three occurrences of those 
bytes on that track, so I found the beginning 
of the checking routine andreplaced the first 
byte of the routine with an RTS (60). 

fi!k Byte From l2 

$2B $1BA A9 60 

Softkey for... 

European Nations And Locations 

Designware (Britannica) 

Evidently they have added another layer 
of protection to this disk since James Harvey 
did his softkey (#74, p.21). The disk format 
has been changed by changing the data 
epilogues in some of the sectors. Fastcopy 
programs will no longer read the disk. Use 
COPYA and tell it to ignore the data epi- 
logues. Then continue with Harvey's crack. 
This gave me a softkeyed copy. 

Step-by-step 

1. Boot your DOS 3.3 system disk. 

2. Tell DOS to ignore epilog errors and use 
COPYA to copy the disk. (Alternative: 
Use COPYA+ and "Ignore" data epi- 
logues.) 



RUN COPYA 




ctrIC 


at the menu 


CALL -151 


enter the monitor 


8925:18 60 




3D0G 


return to BASIC 


70 


to avoid reload of COPY. OBJ 


RUN 


restart COPYA 



3. Make the following sector edits to the 
copy. 

Irk Set Bvte From la 

$00 $03 $9C-A0 A9 38 8D9EB9 EA EA 

EAEAEA 

4. Write the changes back to your disk. 



Rick Davis 



TX 



Softkey for... 

Apple Panic 

Broderbund 

This softkey should work (with minor 
modifications) for most of the Broderbund 
software of a few years back. 

1. Boot your Starter Kit disk, (or DOS 3.3 
System Master). 

2. Insert a blank disk in the drive and INIT 
a Slave disk. 

INIT HELLO 
DELETE HELLO 

3. Enter the monitor. 
CALL-151 

9600<C600.C6FFM Move Disk II code into RAM 

4. Make Boot exit to our code instead of 
the Boot 1 code at $0801. Make the cor- 
rect patch for your computer. 

96FA:98 For II+. He only 

96FD:98 For II gs only 

5. Make the rest of the patches. 

9801 :2C E8 CO stop drive motor 

:4C 59 FF exit to monitor 

9600G load next boot stage 

6. Boot 1 is now in memory. Move the Boot 
1 code up so we can modify it 

9800<800.8FFM 

7. Make Boot 1 move our code and then exit 
to our code instead of the Boot 2 code at 
$0301. 

9805:98 



9843:93 

9301 :2C E8 CO 4C 59 FPSame as in step 5 above 

9600G load next boot stage 

8. Move Boot 2 up to where we can modify 
it 

9300<300.3FFM 

9343:4C 00 90 Jump to our check code 

9000:A5 3E C9 5D DO 03 4C 5D 

9008:02 2CE8 CO 4C 59 FF 

9600G 

This code looks at the current pointer and 
checks it against $5D. If its not equal to $5D, 
it returns to Boot 2. If it is equal to $5D, it 
will stop the disk drive and go to RESET. 

9. Here is where the minor modifications 
will be needed for different software. Type: 

B700L 

Look at the code until you see a JSR to 
some location. This is where the program 
will GOSUB to do the title page and unless 
you actually want to look at this every time 
you can ignore it. Apple Panic is a JSR 
$1000 at address $B745. 

Continue looking at the code by typing a 
L <retum> until you find a JMP to some 
location. Apple Panic has a JMP $4000 at 
address $B771. 

Write the address down. Now modify the 
code at $9800 (Boot 1) with: 
9844:2CE8C04C59FF 

Modify the code starting at $9000 with: 
9809:A94C8D71B7A944 
9810:8D72B7A9 02 8D73B7 
9818:4C00B7 

9809^940 LDA #$4C Jump Instruction 
980B:8D71B7 STA $8771 Use address where JMP 

was found. 
980E:A944 LDA #$44 Low address of modified 

Boot 1 code to go to. 
9810:80 72 87 STA $B772 Address + 1 
9813:A902 LDA #$02 High address of 

modified Boot 1 code to 

goto. 
9815:8D73B7 STA $B773 Address +2 
9818:4C00B7 JMP $B700 Execute DOS code. 
9600G run the changed code 

10. Move game code to safe area. 
2000<4000.93FF 

1 1. Put Slave disk in and boot it with. 
C600G 

12. Save the game code. 

BSAVE APPLE PANIC, A$2000, L$53FF 

13. Load game code at it run location. 
BLOAD APPLE PANIC, A$4000 

14. Resave game code. 

BSAVE APPLE PANIC, A$4000, L$53FF 

Since Apple Panic is a single load pro- 
gram, it will run under DOS 3.3 orProDOS. 

Bitkey for... 

War in the South Pacific 
Strategic Simulations, Inc 

Requirements: 

Bit Copier (I used Copy 11+) 
two blank disks 

A normal RDOS is on the back side of the 
disk. Boot Copy 11 Plus and use Manual Bit 
Copy. Copy the back side with no changes. 

On the front side: 

1 . Change parameter $0B from 1 to 2. (After 
hitting return for what tracks to copy and 
it gives you the menu on the bottom , press 
the 7' key and press the 'B' key and then 
the '2' key. To copy just press return.) 

2. On even tracks ($00, $02, $04, $06, $08, 
SOA, $0C, $0E, $10, $12, $14, $16, $18, 
$1A, $1C, $1E, $20, $22) just press the 
'Q' key. 

2a. On track $01: 

Press the 'F' key, then type D4 AA 96. 

Press the 'C key and type D5. 

Step 2a only has to be done once. 

3. Now press the 'R' key to repeat find 
(when cursor is no longer on a D4 presJs 
'Q' key) 

4. Press the 'C key to change a byte and then 
type 'D5' to change 'D4 to D5'. 

5 . Repeat this until all $22 tracks are copied. 

6. Now copy tracks $00 and $01 firom back 
side to front side. 



There is an Editor program on the front 
side which is now available to change the 
game. 

Softkey for... 

Shiloh 

SSI 

Use same procedure as for War in the 
South Pacific, except do not copy the back 
side tracks $00 and $01 to the front side. 
(They discovered their mistake.) 

Instead on the front side look at Track 
$00 Sector $0A. Place cursor on byte $3E. 
Press 'L' key to look at disassembly. 

It should look like this. (If not it may have 
been moved so scan the disk for it) 

093E:AD78BF LDA BF78 get tracl< identifier 
0941:C9D4 CMP #D4 wasitD4? 
0943;F0 03 BEQ 0948 If BF78 = 04 then 

branch 
0945:EE7BBF INC BF7B Not equal to 04 so 

make It D5 
0948:CEA7BF DEC BFA7 subtract from # of 

sectors to read 
094B:D0E3 BNE 0930 Not all of them read if 

not zero 
0940:60 RTS All sectors read In so 

return 



J L Walters has made a point of 
collecting the complete works ofKra- 
kowicz', one of the more prolific writ- 
ers on copy de-protection in the "early 
days" of Apple computing. Some of the 
material is dated but all of it is inter- 
esting. Beginners should read from 
start to finish, old hands canprobably 
skim thru quickly. There are 22 parts 
in all. We'll print them, in order, in 
upcoming issues. My personal thanks 
to Mr. J L Walters for the time and 
effort he spent in putting together this 
collection and for sending it to us. 

Presented now are parts 1 and 2. 

RDEXed 



Krakowicz 



The Basics of Kracking (part 1) 
ROMs, PROMs and F8's 

Along with a number of requests for 
material useful to those who are not yet in 
the ranks of professionals in this field, it has 
been pointed out to me that I am all too 
willing to suggest burning this PROM, in- 
stalling that ROM, and generally making 
wholesale hardware changes in an unsus- 
pecting Apple, without providing back- 
ground information for the up-and-coming 
Krackists of the future. 

This series, while aimed at the beginning 
to intermediate Krackist, will still assume a 
reasonable knowledge of assembly language. 
If you find these discussions are still too 
heavy into machine code for you, then it's 
best to buy a book like Roger Wagner's 
"Assembly Lines" or equivalent, and study 
it carefully (if, on the other hand, you find 
that this is all beneath you, just keep a 
knowing smirk on your lips as you skip 
lightly over these episodes — there might be 
something you missed because you had a 
bad hangover one day in Kracking 101). 

In this and futare episodes in the "Basics 
of Kracking" series, we'll deal with the 
fundamentals of the Krackist's art, starting 
with the how (and why) of making alterations 
in the Apple's "permanent" memory. First 
of all, the most important single tool avail- 
able to the aspiring Krackist is replacing the 
autostart ROM on the mother board with an 
"old monitor" ROM. With this ROM in 
place, you can hit "reset" whenever you 
want, and always be returned to the monitor 
for the beginning of the snooping process. 
This change, incidentally, will make avail- 
able to you a reasonable set of "step and 
trace" utilities (see the Apple II Reference 
Manual, pp 51-53). 

To understand what the differences are 
between the two ROMS , let's take a minute 
to examine what pressing the "reset" key 
does (omigosh, Maude, there he goes again 
on that detailed technical crud!). Instead of 
going through the keyboard input routine at 
$C(XX), the reset key is connected directly to 
pin 40 of the 6502 microprocessor chip. 



When this pin is connected to ground (0 
volts), the computer jumps unconditionally 
to the address contained in locations $FFFC 
and $FFFD. This is not a true interrupt, since 
the Apple forgets what it was doing before 
the line was "yanked," but it is an example 
of "vectoring" or sending the computer to a 
specific place by setting an address into the 
program counter. In the autostart ROM, 
these two locations contain $62 $FA, so the 
next instruction to be executed is at $FA62. 
This series of routines (see p. 143 and pp. 
36-38 of the reference manual) checks to see 
if the computer is being powered up for the 
first time (coldstart) or reset with the power 
on (warmstart). If it is a warmstart, the 
system jumps to the instructions at locations 
$3F2 and $3F3, and begins running die 
program found there (usually basic at $E000). 
The "old monitor" ROM, however, has $59 
$FF stored in $FFFC-D. This causes an 
Apple II (or a 11+ with an integer card and the 
red switch "up") to go to routines which set 
up the keyboard for input, the TV for output, 
and wind up in the monitor with the "*" 
prompt displayed. In contrast to the AU- 
TOSTART Rom, where anyone can tell the 
reset button where to go, there is no way to 
prevent a reset Irom going to $FF59 and 
winding up in the monitor. This is obviously 
essential if you want to break into a game 
and start examining the code, but it has its 
own set of problems. 

In the process of setfing up the I/O de- 
scribed above, especially in setting up the 
text window on the screen, a number of 
locations in zero page must be changed. The 
following locations will probably be altered 
(all hex): 20, 21, 22, 23. 24, 25, 28, 29, 32, 
33, 35. 36, 37, 38, 39, and 48. Worse than 
that, the entire screen scrolls up one line 
when the monitor prompt is printed, which 
loses the entire top row of the text screen 
(locations $400-$427), and alters the contents 
of all the other locations from $400-$7FF, 
with the exception of the "scratch pad" 
regions at $478-$47F, $4F8-$4FF, etc. (The 
computer wimp at your school says that the 
top line "falls into the bit bucket," but you 
know how everyone feels about him.) 

As most software protectors know, this 
will keep most of the amateurs out of the 
program, and you'll see evidence of this 
technique in the form of a lot of "garbage" 
on the text screen when you reset out of a 
protected game. Our job, then, is to keep 
these zero page and screen memory locations 
.from being lost, since most protection 
schemes use these areas in some way or 
other (Broderbund, for example, has recently 
been storing the address marker for the disk 
track in locations $20, $21, and $22). 

The safe way to prevent information from 
being lost from these "volatile" locations is 
to transfer all of the contents to a safe area — 
Locations $2000 & up (or $4000 & up) 
where a HI-RES picture normally resides. 
In fact, it would be best to save everything 
from $0 to $8FF, since booting a diskette to 
save the data also destroys locations $800- 
$8FF. (Remember the first law of disk 
kracking - track 0, sector always starts 
with D5 AA 96 and always loads into $800- 
$8FF). Because this is the beginning class, 
let's look at two examples of short binary 
subroutines that will do the "save" for us. 
Both start, as will be explained later, at 
location $FECD in the F8 ROM. The first is 
the most straightforward and easiest to fol- 
low: 



LDY #$00 

LDA $00,Y 

STA $2000,Y 

LDA $0100,Y 

STA $2100,Y 

LDA $0200,Y 

STA $2200,Y 

LDA $0300,Y 

STA $2300,Y 

LDA $0400,Y 

STA $2400,Y 

LDA $0500,Y 

STA $2500,Y 

LDA $0600,Y 

LDA $2600,Y 

LDA $0700,Y 



;clear Y-register 

;Get a byte from 0+Y <— $FEDO 

;store at 2000+Y 

;thenfrom100+Y 

;to2100+Y 

;and so on until 

;we have covered 

;all the memory 

I'pages' from to 8 

;and stored into 

;pages 20 to 28 
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STA $2700,Y 

LDA $0800,Y 

STA $2800,Y 

INY ;thenadd1toY-reg 

BNE $FEDO ;an<l repeat if < 256 

JMP $FF59 iwhen we're all done jump to 
monitor start 

This 61-byte routine, if it could be exe- 
cuted automatically when the reset key is 
pressed, would safely stash all of the 
changeable memory and exit gracefully into 
the monitCH'. 

A more compact and general, but less 
obvious, routine is shown below. It is in- 
cluded because it is typical of the "memory 
move programs" that we will eventually 
have to write in krackingalmost any program. 

LDY #$00 idearY-register 

LDA $00,Y ;Xler the zero page to <—$FEDO 

STA $2000,Y ;2000-20FFsowecanuse 

INY ;the zero page memory 

BNE $FED0 ;for the ottier moves 

IDA #$00 ;Set up locns & 1 as a 

STA $00 ;2-byte pointer for the 

STA $02 isource address, Use 2&3 

LDA #$01 ;as 2-byte pointer for 

STA $01 ;the destination address 

LDA #$21 ;startlngat$2100 
STA $03 

LDA ($00) <- ;Getabytefrom100-up 

STA ($02) " ;storeat2100-up 

INC $02 * ilncrementlo-orderbyte 

INC $00 " :of source & destination 

BNE ->->->• :(backtoLDA($00) 

* ;lflo-orderis<256 

INC $03 " :lflo-otder = 0,lncthe 

INC $01 " :Hi byte of each 

LDA $01 " ;Checktoseeifhi-byte 

CMP $#09* ;is9-We'rethruat8FF 

BNE ->->->* ;lf not, loop back to 

;the load&tore until 

:we're all done 

JMP $FF59 ;Exit thm monitor 

Unlike the first routine, this one (at 47 
bytes) uses RAM locations through 3, so 
the zero page must be transferred before it is 
altered by using those addresses as pointers. 
While the first routine must grow by six 
bytes for each additional page transferred, 
the second needs only to have the "9" in the 
compare statement changed to the appro- 
priate value one higher than the last page 
number being transferred. 

To return to the business of altering 
ROMs, it is easy to see that an autostart 
ROM could be made to behave like an old 
ROM just by changing locations SFFFC-D 
to $59 $FF from $62 $FA. (A note to the 
faint hearted: you can buy an old monitor F8 
ROM for about $ 10 and plug it directly into 
your Apple's F8 socket, but you won't have 
all the benefits we've been talking about). 
As long as we're going to the effort of 
making a change, though, we might as well 
add one of the routines above and allow the 
new ROM to save the volatile memory for 
us. To do this, we'll have to give up some- 
thing in the ROM, and the most easily sur- 
rendered area for most of us is the tape read/ 
save routines at $FECD. If we then changed 
$FFFC-D to $CD $FE, the memory from $0 
to $8FF would be saved to $2000-$28FF 
every time the "reset" key was pressed. 
Since it's sometimes inconvenient to have 
that happen when the reset key is pressed, 
we can require that a specific key also be 
pressed to make it occur. These few in- 
structions inserted before either of the rou- 
tines above will give a "reset and save" 
when the "-" key is held down (or was the 
lastkey pressed), while giving aregular"old 
reset" the rest of the time. 

LDA $C000 Look at the keyboard 
ROL Mask off high bit 

CMP #$5A Was it •-■? ($2D X 2=45A) 
BNE ->->-> If not, branch to the location with 
the "JUMP FF59" instruction at the 
end of the save subroutine. 

OK, OK - We all agree that these would 
be neat things to have in the F8 ROM, so 
how do we get it there? First, get hold of a 
PROM burner (PROMBL ASTER, EPROM 
PROGRAMMER, etc.) that will program 
2716 EPROMs. Each one is different, so I 
won't try to give detailed instructions on the 



actual programming. Buy or borrow a 
friend's old F8 ROM (or get the binary file) 
then type in or load in the changes you want 
to make at $FECD & up and at $FFFC-D, 
and program a 2716 EPROM with our 
modified version of Apple's F8 monitor 
ROM. 

All that remains to take full advantage of 
the new F8 ROM is to make a slightly 
modified socket and plug it in. Both the 
2716 and the original 9316 ROM used by 
Apple are read-only-memory devices hold- 
ing 2K by 8 bits of information ("16K" 
ROMs), but the pinout, or assignment, of 
chip functions to pin numbers is slightiy 
different To use the 2716 in a board de- 
signed for a 9316, you need to tie pin 21 to 
5 volts (pin 24) and tie pin 18 to ground (pin 
12) . You could modify the PROM itself, but 
you're liable to ruin the chip, and it creates 
a real magilla if you need to reprogram it. (A 
ROM card, such as an integer card, can be 
used for 27 1 6' s if two jumpers are connected 
at the top of the card, and ->only,<- 2716's 
are used in all of its sockets after that). 

Get a 24-pin, preferably low-profile IC 
socket and orient it with the pins up and the 
notch indicating the "pin one" end to the 
right. It should look like: 

I 13 14 15 16 17 18 19 20 21 22 23 24 I 

I ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ ./ I 

I I 

I I 

I e-@ 

I Notch -> I 

I e-e 

I I 

I I 

\ I I I I I / I I / I I I I 

112 11 10 9 8 7 6 5 4 3 2 1 I 



Using a low- wattage soldering iron, sol- 
derashortpieceof26-30gauge wire between 
pins 21 and 24, and another one between 
pins 12 and 18. Make the connection as 
close to the socket as possible, and try to 
avoid getting any solder on the ends of pins 
12 and 24. Cut off pins 21 and 18, again as 
close as possible to the socket. (Plugging 
another socket into the one being modified 
will help to prevent distortion during the 
surgery). The socket now looks like: 



13 14 15 16 17 
./ ./ ./ ./ ./ / ./ 
X 
/ 
/ 
/ __/ 

/ 



19 20 21 22 23 24 | 
X / 



/ / 
I / 

Notch — > 



I / . . . . 

\ I I I I 

112 11 10 9 



I 
I 

8-9 

I 

g-g 

I 

I 
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I I 
2 1 



X = No pin 

Double check the connections on the 
bottom of the socket, and plug the 2716 into 
the socket, being careful to match the notched 
end of the chip to the socket. Make sure that 
the power to the Apple is turned off, and 
plug the assembly into the F8 socket on the 
mother board with the notch toward the 
front (keyboard) end of the Apple. Cross 
your fingers and turn on the Apple. If there 
is no familiar "beep", or if the TV screen 
stays white, or if the system doesn't respond 
to the reset key, turn off the power and 
examine the chip and socket carefully to 
find the error. If black clouds of smoke roll 
out from the Apple, forget where you read 
this. Actually, the most common mistake of 
inserting the chip backwards is seldom 
harmful to it, but does lock up the Apple's 
bus. Remember that both the 2716 and the 
93 16 that you removed can be damaged by 
static electricity, so handle with care and 
don't scuff your feet on the cat. 

The Basics of Kracking part 2 

Single-Load Games, 

Starting Locations, and Obfuscation 

The first in this series was straightfor- 
ward, since the hardware reset is a necessity 
to begin kracking. After that, the path di- 
vides, and there are many ways to producing 
an unprotected version of a program. The 
path you follow is governed by three things: 
The kind of program, the type of protection 
employed, and your own personal style. 
(Style, by the way, is primarily the result of 



limitations.) Try to keq) an open mind and 
develop as much versatility as possible). 
The easiest kind of program to deal with is 
the one that is seen less frequently every 
month: The "single-load" program or game. 
These are programs which are loaded in 
from disk only once, and then are run strictly 
from memory with no disk access. In the 
good old days, almost every game was like 
this, and removing protection was not that 
difficult On the other hand, when you read 
something like Olaf Lubeck's challenge in 
track $17, sector $D of CANNONBALL 
BLITZ: "You'll never crack it", there's more 
satisfaction when you get to say "oh, yes I 
did!". 

In order to become proficient at this and 
the techniques to be discussed in future 
episodes, you will have to get used to com- 
mitting a very unnatural act: Interpreting 
assembler code with no comments or in- 
structions to guide you. The disassembler 
(monitor "L" command) is a great help in 
this work, since it translates machine code 
into assembler mnemonics, but the real 
burden falls on the ingenuity of the krackist 
There is no substitute for experience, and no 
one can teach you how to do it beyond 
pointing out some of the techniques we use 
and warning you about some of the tricks 
used to keep you from succeeding. 

The philosophy ofattack with these games 
is to find the starting location — the address 
which will always restart the game and then 
to save the game (program) as a normal 
DOS 3.3 binary file. As a simple example of 
a starting location, you probably already 
know that when you mess up with Apple's 
"FID" program, you can restart by typing 
"803G" from the monitor. At one time, 
before the publishers got smart, a starting 
location was likely to be a common, even 
number like $800, $C00, $4000, or $6000, 
and it's still worth checking these old fa- 
vorites" in case you find a naive or lazy 
author. If these fail, we will have to begin the 
process of memory snooping. This is the 
introduction to the unglamorous activity 
that occupies most of the time of the dedi- 
cated krackist. As always. Inspector and 
Watson in ROM are highly recommended, 
since they make the process infinitely easi- 
er. What we are trying to do is directly locate 
the beginning address of the program, or to 
search back to it from something we can 
recognize. 

Since many games begin by displaying a 
HI-RES "banner" or game screen, a good 
place to start looking is the series of in- 
structions that set up the HI-RES screen 
(there is a discussion of this in the doc for 
Masterkey Plus, but they make a few too 
many assumptions). Apple' s screen display, 
as you probably know, is set up by accessing 
some "soft switches", in hex, these are lo- 
cations $C050 to $C057 (sorry , but if you're 
going to learn the gentle art of kracking, 
you'll have to become fluent in hexadecimal 
— wewon'tpuU any punches when it comes 
to number systems). It doesn't matter what 
you do to these locations, as long as you 
make a reference, so the following instruc- 
tions all establish graphics mode: 

LDA $C050 

BIT $C050 

ROL $C050 

STA $C050 

CMP $C050 

EOR $C050 

(Also, this one: LDY #$71 then LDA 
$BFAF,Y) 

Many authors have established the habit, 
however, of writing the sequence: 

LDA $0054 Select prima7 page 
LDA $C057 Select Hi-res graphics 
LDA $C050 Select graphics mode 

and sometimes, 

LDA $C052 Pure graphics screen 

To find these instructions, use the In- 
spector's "find" function, and program it to 
search for the two-byte sequences of "50 
CO" and "57 CO". Generally, as long as the 
writers aren't deliberately trying to confuse 
you, you will find one to several locations 
where these sequences are close to each 
other. You will also find some addresses 



that don't really contain a screen reference, 
since the search is only for two bytes (for 
you trivia statistics buffs out there, a given 
two-byte sequence would occur less that 
once in the entire RAM memory space from 
$0 to $BFFF if the distribution were truly 
random. It's not). 

To see if each occurrence of the pattern is 
the starting location, look backwards until 
you find an absolute end for the previous 
subroutine such as "RTS" or "JMP". Your 
subroutine should begin immediately after 
that, and you should assume for the moment 
that it's the starting location. If, for example, 
the location you found is $4123, test it by 
reloading the game, resetting it, and typing 
"4123G". If it runs, sit back and gloat oth- 
erwise read on (it sounds unnecessary to 
reload, but the Inspector uses a few locations 
in pages 0, 2, and 3, so it's best to be safe). 
If Murphy's law of dynamic negatives is 
with you and the game didn't start, it's 
usually because you haven't found the true 
starting location. You then need to ttace 
back further in the program sequence to find 
the real start. 

There are three ways for another routine 
to get to the one you're looking at: JMP, 
JSR, and the family of branch instructions. 
To eliminate the third possibility, keep in 
mind that branches can reach up to $7F 
(127) locations away from either direction, 
this is equal to about 60 instructions, so you 
should review about one full page of disas- 
sembly printout (three screens full) before 
and rarely after what looked like a possible 
start. If you find a "BNE $4123", or "BCC 
$4123", etc., you will have to track back to 
the beginning of that routine and try again. 
Repeat this process until you find a location 
that can only be reached by a JMP or JSR. 

To find out how the program got to this 
location,doa3-byte search with the Inspector 
fora JSR $4123: 20 2341. If nothing shows 
up, try the JMP $4123: 4C 23 41. One of 
these must produce a reference, or you 
messed up the earlier check for branches. 
Once you find the earlier reference, go 
through the same procedure to find the start 
of this routine, and try it out as a starting 
location for the game. If it doesn't work, try 
one more step further back (Krakowicz's 
fourth law of kracking says that if you have 
to go back more than two steps, you're 
probably not on the right trail). 

A number of games still do us the favor of 
putting up a screen, perhaps playing a little 
music, and then waiting for the space bar or 
other key to be pressed. If it's not possible to 
find the screen setup, we still have a fairly 
obvious "hook" into finding the starting 
address, and in many cases the game can be 
saved "as is" by using the keyboard routine 
as the starting address. Don't worry for now 
about exactly how we will "save the game." 
we'll go through that carefully and thor- 
oughly in the next episode. 

Since the keyboard address is $C(XX), we 
can usually locate all the inputs by searching 
for the 3-byte sequence of "AD 00 CO" with 
the Inspector. Occasionally, the X or Y 
register is used to load keyboard data, so the 
sequences AC 00 CO and AE 00 CO should 
be tried if the first comes up blank (only the 
real bast — ds like Sirius use LDY #$67; 
LDA$BF99,Y for the keyboard input). Also, 
keep in mind that all the addresses from 
$C000 to $COOF will access the keyboard, 
and if someone was really determined to 
confuse you they could use $C007 one time, 
$COOD the next and so on. If you know that 
the game uses the keyboard and the pre- 
liminary searches don't show how, keep on 
looking for these addresses, or the Sirius- 
type computed addresses. Itprobably means 
they have something to hide, and locating 
the keyboard read will reveal enough to 
make the search worthwhile. 

If the program is waiting for the space 
bar, you will usually find a sequence like: 

78E0 LDA $0000 Read the keyboard 

* CMP #$A0 Was it space? 

* BNE $78E0 Nope, keep trying 
JMP $6012 Yes, go to start 

*These two lines are eliminated if press- 
ing any key will start the game. 
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To check out $60 12 as a starting address, 
set up to view the HI-RES screen (otherwise 
the game might be running while you watch 
a blank text screen) with: $C050 (CR) $C057 
(CR), then type 6012G. As before, you will 
know at once if you were successful. 

Another way to find a restart point is to 
search through the keyboard input routines 
for a restart key. It has become conventional 
to use CTRL-R as the restart command 
(occasionally CTRL-S or CTRL-B), and 
this is even easier to trace. In one of the 
routines following a SCOOO reference, you 
will find a CMP #$92 (see the reference 
manual, p. 7 for the hex values of the key- 
board). The location branched to or jumped 
to by a successful compare will be the restart 
for the game. Again, you can save the game 
as is and use your new-found starting loca- 
tion. 

Iftheserelativelysimpleapproachesfail, 
you'll have to resort to the real grunt type of 
detective work — looking for something 
promising (we'll discuss boot-tracing as an 
alternative way of getting to this point in 
another episode devoted entirely to that 
technique). Likely things to look for are 
"setups", where a lot of zero page locations 
are initialized to begin the game: 

LDA #$00 

STA $23 

STA $57 

LDA #$12 

STA $30 

LDA #$E9 

STA $72 
etc. 

Or, sometimes, a game start is indicated 
by a subroutine sequence which maps out 
the path for the game (this is an indication of 
an experienced, well-disciplined program- 
mer and thus is more commonly seen in 
business or professional programs, rarely in 
game programming). 

JSR $8CD 

JSR $CE4 

JSR $2020 

JSR $203D 

JSR $8FE 
etc. 

And, although it's less often the start of a 
program or game, a "jump table" can be a 
significant clue to the organization of the 
program: 

JMP $204D 

JMP $2433 

JMP $EF2 

JMP $2077 
etc. 

Unfortunately, snooping for these is a 
time-consuming, hit-and-miss operation, the 
real starting address can be anywhere from 
$0000 to $BFFF (or even via a basic sub- 
routine in $D000-$F7FF, but I don't want to 
discourage you yet). 

While it will be disconcerting to the be- 
ginner, as you get more experience you 
begin to enjoy defeating various deliberate 
attempts to throw you off the trail — the 
general subject of obfuscation, or intentional 
lack of clarity. Because the major software 
companies know we're out here waiting for 
their latest output, they often try to misdirect 
us or find innovative ways of hiding sensi- 
tive portions of the program with a variety of 
techniques. Take a look at the following 
piece of code from On-Line's Cannonball 
Blitz: 

59E4CEE759 DEC $59E7 

59E7CF ??? 

59E8:EA NOP 

59E959EFEA EOR $EAEF,Y 

59EC:59AD51 EOR $51AD,Y 

59EF:C0AD CPY #$AD 

59F1:54 ??? 

59F2:C0AD CPY #$AD 

59F4:57 ??? 

59F5:C0AD CPY #$AD 

59F7:52 ??? 

59F8:C020 CPY #$20 

59FA:60 RTS 

59FB:5B ??? 

59FC:20C5 5B JSR $5BC5 

59FF:204E5B JSR $5B4E 

This is an example of "self-modifying 



code"-instructions that change as the pro- 
gram is run. It's dangerous and generally 
poor programming practice, but it can be 
used to throw the dogs off the scent. At first 
glance, it looks like data or garbage stuck in 
before some real code. Let's look at exactly 
how it works. Executing the first instruction 
changes the second instruction from junk 
into a legal instruction: 

59E4:CEE759 DEC $59E7 

59E7:CE EA 59 DEC $59EA 

59EA:EF ??? 

59EB:EA NOP 

59EC:59AD51 EOR $51 AD ,Y 

59EF:C0AD CPY #$AD 

(If you have an old monitor ROM, you 
can type 59E4S to execute the first instruc- 
tion). If we execute the second instruction, 
the entire picture changes: 

59E4:CE E7 59 DEC $59E7 

59E7:CEEA59 DEC $59EA 

59EA:EEEA59 INC $59EA 

59ED:AD51C0 LDA $C051 

59F0:AD54C0 LDA $C054 

59F3:AD57C0 LDA $C057 

59F6:AD52C0 LDA $C052 

59F9:20 60 5B JSR $5B60 

59FC:20C5 5B JSR $5BC5 

59FF;204E5B JSR $5B4E 

5A02:A904 LDA #$04 

5A04:8DECB7 STA $B7EC 

5A07:A900 LDA #$00 

5A09:8DEBB7 STA $B7EB 

5A0C:A9 00 LDA #$00 

5A0E:8DF0B7 STA $B7F0 

5A11:A960 LDA #$60 

5A13:8DF1B7 STA $B7F1 

5A16:A940 LDA #$40 

5A18:2045 5A JSR $5A45 

5A1B:10 01 BPL $5A1E 

5A1D:A9 20 LDA #$20 

5A1F:915A STA ($5A),Y 

5A21:AD50C0 LDA $C050 

5A24:A90g LDA #$09 

Suddenly, the screen setup code that was 
always there pops into view. This points out 
the value of searching with the Inspector, 
since even the closest scrutiny would prob- 
ably not have made you suspect what was 
actually here. Notice, too, that the third 
instruction increments $59EA, so once it's 
been run, it's obscured again. 

Another standard trick, also shown in 
this example, is called "false disassembly", 
and is dear to Edu-Ware, On-Line, IDSI, 
and Scientific Research Associates. Here, 
extra bytes are added for the sole purpose of 
giving a false indication of program flow; 
the fake bytes are then branched around. 
Look closely at the instruction in $5 A IB-it 
says BPL $5A1E. The next instructions in 
sequence appear to the casual eye to be LDA 
S#20; STA ($5A),Y. Actually, the next in- 
struption is JSR $5 A9 1 . This is crucial, since 
this subroutine loads in the game and does a 
nibble count. To see a whole bunch of false 
disassemblies in a row, look at the code in 
the actual subroutine: 

5A91A900 LDA #$00 

5A93:1001 BPL $5A96 

5A9520A859 JSR $59A8 

5A98«0 BRK 

5A99:27 ??? 

5A9A:C8 INY 

5A9B:D0FA BNE $5A97 

5A9D:8510 STA $10 

5A9F:F001 BEO $5AA2 

5AA1A9A9 LDA #$A9 

5AA3:205900 JSR $0059 

5AA6:27 ??? 

5AA7:C8 INY 

5AA8:C8 INY 

5AA9:D0F9 BNE $5AA4 

5AAB:8511 STA $11 

5AAD:49 B7 EOR #$B7 

5AAF:48 PHA 

5AB0:A510 LDA $10 

5AB2:4911 EOR #$11 

5AB4:48 PHA 

5AB5:D0 01 BNE $5AB8 

5AB7:4C60 08 JMP $0860 

5ABA:60 RTS 

I Strongly urge you to sit down and figure 
out exactly what the real program is here, 
and if possible, what it does. Cover up the 



explanation below, and go through the code 
byte by byte to eliminate the fake bytes. It's 
not just character-building — if you go 
through a few of these, you'll learn to recog- 
nize them when they pop up. 

Those of you who really went through it, 
give yourselves four kracking honor points. 
For the rest of you, here's a Usting of the 
functional equivalent (some addresses are 
changed because the junk bytes have been 
taken out): 

5A91:A900 LDA #$00 

5A93:A8 TAY 

5A94:5900 27 EOR $2700,Y 

5A97:C8 INY 

5A98;D0FA BNE $5A94 

5A9A:8510 STA $10 

5A9C:A9 20 LDA #$20 

5A9E:5900 27 EOR $2700, Y 

5AA1;C8 INY 

5AA2:C8 INY 

5AA3:D0F9 BNE $5A9E 

5AA5:8511 STA $11 

5AA7:45B7 EOR $B7 

5AA9:48 PHA 

5AAA:A510 LDA $10 

5AAC:4911 EOR #$11 

5AAE:48 PHA 

5AAF:60 RTS 

This is also valuable because it in troduces 
the concept of "jumping through the stack. 
The RTS instruction transfers the two bytes 
above the stack pointer in page one to the 
program counter, increments the low byte 
by one, and jumps to that location . Ordinarily, 
the bytes on the stack were placed there as a 
return address by the JSR instruction. In this 
case, in very roundabout fashion, the On- 
Liners have pushed two bytes on the stack 
and executed an RTS, which jumps to the 
location one higher that the values stored. 
The story of the subroutine goes like this: 
create a checksum by exclusive-oring to- 
gether all the bytes from $2700 to $27FF, 
and store it in $ 1 0. This allows a check to see 
if any of the bytes in the nibble countroutine 
were altered. Do a second checksum on 
every other byte from $2700 to $27FF, 
starting with a value of #$20. Store this in 
$11, then exclusive-or it with #SB7 to pro- 
duce the low byte of the return address: $FF. 
Push this on the stack, exclusive-or the first 
checksum with #$11 to produce the return 
high byte of $26, then do the RTS to jump to 
$2700. When you look at $2700, you find 
this: 

2700:CE 03 27 DEC $2703 

2703:EF ??? 

2704:03 ??? 

2705:27 ??? 

2706:AD24 27 LDA $2724 

2709:49 8A EOR #$8A 

270B:D0 01 BNE $270E 

270D:20 8D24 JSR $248D 

2710:27 ??? 

2711:D0 01 BNE $2714 

271 3:40 AO 25 JMP $25A0 

271638 TYA 

2717:5900 27 EOR $2700,Y 

271A390027 STA $2700,Y 

271D:C8 INY 

271E:D0F6 BNE $2716 

(You see, now that we're familiar with 
this kind of trick, there's nothing to decod- 
ing that mess, is there?) 

Stay tuned to Computist for part 3, when 
we finish this subject by answering the 
burning question "what is the window-shade 
technique?", and proceed to a discussion of 
memory moving and file saving. 
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with a sector editor I discovered that track 0, 
sector 0-9 are in normal format Track 0, 
sector A-F and track 1-22 are unreadable. A 
bit copy will not run. Breaking out of the 
program with the Senior Prom NMI and 
looking at the memory reveals the RWTS is 
in normal location at B800 and can be cap- 
tured. The program can be converted to 
normal format but will not run with normal 
DOS. Accordingly we have to convert the 
whole disk from track $00-22 to normal and 
sector edit the markers to be able to make a 
functioning copy. All prologues and epi- 
logues are changed except for track sector 
0-9. 

To be able to make a bit copy and even- 
tually unprotect the program , we need to use 
the captured RWTS to copy track 1-22, then 
modify the controller to copy track 0, sector 
A-F, and use a sector editor or a copy pro- 
gram that ignores errors to copy track 0, 
sector 0-9. The information required to 
achieve all this was discovered by snooping 
through memory to locate the Headers and 
Trailers used by the game and making 
modifications to Copy II Plus for the bit 
copy and to Super lOB with Newswap 
controller to unprotect. The information 
needed consisted of the following: 

changed normal 
Address Prologue 99C9A5 D5AA96 
Address Epilogue C9CCEB DEAAEB 
Data Prologue E4A4D4 D5AAAD 
Data epilogue C9CCEB DEAAEB 

Step-by-step 

1 . Boot Copy II Plus and enter the bit copy 
section. 

2. Use bit copy option to copy track 0. 

3 . Use sector copy option to copy track 1 -22 
with following parameter changes: 

57=99, 58=C9, 59=A5. 5C=C9, 5D=CC, 
61=E4, 62=A4, 63=D4, 66=C9, 67=CC 

This allows the sector copy program to 
read the disk properly and will produce a bit 
copy that will boot and run normally. 

Softkey for... 

The Usurper: Mines of Qyntarr 

Sir Tech 

Requirements: 

Super lOB with Newswap controller 
One blank disk 
Sector editor 

A way into the monitor is desirable 
A fast copier that ignores errors may be 
helpful 

To completely unprotect you need to be 
able to interrupt the program and capture the 
RWTS. I used the Senior Prom. Hitting 
Control-Reset will also work most of the 
time. I am sure someone who is proficient in 
writing controllers can accomplish the whole 
procedure including the sector edits and 
capturing the normal part of ttack all in one 
controller. I am unable to do this and will 
describe a round about way of doing this. 
Maybe someone else will use this informa- 
tion to write a controller to accomplish all 
this. 



Bitkey for... 

The Usurper: Mines of Qyntarr 

Sir Tech 

Requirements: 

Copy II Plus 

This program is an all text adventure 
game with an excellent parser. I have been 
try ing to copy it for the past year but have not 
succeeded. It will not copy with any of the 
available copy programs including EDD 
with card. It uses a DOS that has been 
modified drastically. Looking at the disk 



Step-by-step 

1. Boot the original and when you start 
playing interrupt with NMI or Control- 
Reset. Check to make sure the RWTS is 
still intact at B800 by listing the code at 
B800. 

2. Move the RWTS to $1900. 
1900<B800.BFFFM 

3. Save the RWTS to your Super lOB disk. 
Use the name "RWTS.XXX" — same as 
the name in the Newswap controller line 
10010. 

BSAVE RWTS.XXX, A$1900, L$800 

4. Format a disk with normal DOS. 

5. Copy track 0, sector 0-9 by either allow- 
ing a fast copier that ignore errors to do 
this or use the sector editor to read one 
sector at a time and writing to the copy. 
Although this may take a couple of min- 
utes, it is much simpler for a beginner. 

6. Next step involves capturing the main 
program from track 1-22 using the Super 
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lOB. Boot the Sup^ lOB disk ^uid use the 
Newswap controller. When it asks if you 
want the disk formatte4 hit control-reset 
to enter BASIC and get ']' prompt. Now 
list line 1010 and you should ^e the 
following "1010 TK=3:LT=35:ST=15: 
LS=15:Cl>=WR:FAST=r. This tells the 
copy program which track to start at and 
which sector etc. Change the TK^S to 
TK=1 to have it start copying from track 
1 to 22. Now while the Super lOB disk is 
still in the drive type RUN and press 
return. The disk drive will come on for a 
moment and you are b^k in the copy 
program. Proceed to make a copy ^d tell 
it NOT to format the disk when it asks. 

7. The next step is to cj^ture track 0, sector 
A-F. Run Super JOB with Newswap 
controller and break out of the program as 
in step 6. List line 1010 and this time 
change to the following 1010 
TK=0-l,T=aST=15iS=9:CD=WR:FAST=l 
and press return. Then type RUN and 
press return. Now proceed to make the 
copy. Now we have converted the whole 
disk to normal format 

8. The only thing left is to tell the original 
DOS that we are using normal markers. 
Useyour^ctoreditoranddothefoUowing 
sector edits: 

M Ssi Ms. 

$00 $03 $55 

$00 $03 $5F 

m $03 $6A 

$00 $03 $91 

m $03 $9B 

$00 $02 $E7 

m $02 $F1 

$00 $02 $FC 

$00 $03 $35 

$00 W $3F 

This completes the normalizing of the 
disk and produces an unprotected version 
that uses the original DOS. I would love to 
see one of the experts tackle the job of 
putting all this together into one controller. 
ITiis would be of great educJttional value to 
me and will help me in die future to simplify 
writing controllers. I hope I included all the 
information needed to do this job. How 
about it experts? 

Softkey for... 

Typewriter 

Power Up 

Requirements: 

Blank disk 

Any whole disk copier such as COPYA, 

Locksmith Fast Copy etc. 
Sector editor 

This iMX)gram is dated 1985 .It allows you 
to use your computer as a typewriter. It 
prints one line at a time. This program is 
written in Pascal and is COPYA-able. ITiis 
indicates that the format is namal and the 
disk uses a nibble count for protection. A 
working copy can be made using Essential 
Data Duplicator but requires several tries to 
make a reliable copy. Because of this I felt it 
best to remove the protection completely 
and free the program. 

Step-by-«tep 

1. Make a copy of the disk with COPYA. 
This copy will not run because of the 
nibble count 

2. Sector edit the copy to bypass the nibble 
count by putting a jump over it. If the 
protection has b^n moved on ycmr disk, 
then scan for AD E9 CO. You will find this 
in only one locMirai on the disk. 

Iris ^ 3M From Ifi 

$0D $08 $3E-40 ADE9C0 18904C 
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Copy 11 Plus. I was unable to accomplish 
this, but I can make reliable copies using 
EDD v4 using Reanalyze {X)=90 or 00=B0. 
Using any other method will produce a copy 
that will run normally for the first two levels 
only. When asked to turn the disk over for 
the rest of the levels the program crashes. 
The method I used will produce a reliable 
copy and I can assure your readers of this 
since I have completed the game. Also I 
would like to say that this is one of the best 
games for the Apple 11 to be published for a 
long time. 

Softkey for... 

Star Sank Boxing n 

GamestarlAcdvision 

Requnremente: 

Original disk 
Blank disk 
Sector editor 

Whole disk copier such COPYA or Lock- 
smith fast copy 

This disk copies without errors with any 
copier. The format is normal and scanning 
the disk for the usual Activision protection 
code reveals this to be present on track 00, 
sector 9 starting at byte 12. Trying to bypass 
the protection with the usual methods de- 
scribed in previous Computist issues for 
Activision does not work. Apparently they 
have been reading Computist and left the 
protection intact, but added a different form 
of protection. The new protection can be 
found on track 1 , sector 5 and 8. A bit copy 
can be made by using Essential Data Du- 
plicate V 4 by using Reanalyze 00=B0. 

I di«x)vered thept)te«tion when I scanned 
the disk for the error message displayed 
when the copy is booted. The screen dis- 
plays "PLEASE PUT ORIGINAL IN 
DRIVE 1". This code was found in two 
locations. This is the protection code that 
does a disk check if not original and I found 
it can be bypassed by simply putting a "60" 
or return at its beginning. If your copy has 
the code in a different location, then scan for 
2C 54 CO 2C and change the first 2C to 60. 

Step-by-step 

1. Make a copy of the disk with any whole 
disk copier. 

2. Sector edit the copy 

Ids ^ E^ From ISl 

$00 $05 54 2C 60 

$08 39 ^ m 

This should bypass the protection com- 
pletely. 



Edward Eastman 
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Prince of Persia 



Requirements: 

EDDv4 

I agree with several of the readers in 
Computist 75 who wrote about this pro- 
gram. The format is very difficult to unpro- 
tect and is similar to Wings of Fury. It was 
suggested that a bit copy can be made using 



Attention all Readers, Computist is 
looking for any small programs you may 
have developed few your own use. I chatted 
with Computist a while back and we dis- 
cus^ many topics. Om direction mentioned 
for the magazine was expanding into pro- 
grams for other readers. Any utility or game 
or programming caveat is welcome, so long 
as it is relatively small. However, let Com- 
putist determined if it is too large. So if you 
have a nifty one Uner or neat algorithm send 
it in to help your fellow enthusiasts. Having 
had advance warning, here is my donation to 
the cause, 

Epson Label Printer 

This litde gem was inspired by a box of 
one inch labels that I squired quite a while 
ago. I found them handy to use as disk, 
address and return address labels. Unfortu- 
nately, I had to fire up my word processor 
just to put text on one. Plus I was constantly 
looking up control codes for the framatting 
I wanted. As I always do, I thought 'there 
has to be an easier way ' . Searching through 
oldmagazines I foundaprogram thatprinted 
l^jels for an Apple DMP, but I have an 
Epson. 

All hope was not tost because I am a 
decent BASIC programmer. Browsing 
through my printer manual, I found all the 
information I needed. I discovered how to 
access my printer's special modes as well. 
This is my best BASIC effort yet You will 
haveaccesstocondensed,draftitalics,NLQ 



if your printer has it, and be able to print six 
or eight lines per inch (label). 

Using the program 

First, when you enter a control letter into 
a label, it will appear as a blank until you 
press 'return', then it will turn invert on the 
screen. Second all control characters are 
accepted but only the ones listed will be 
ccMiverted into printer control codes, that 
way you can still send special codes without 
modifying theprogiam. TTiird, whileediting, 
the left arrow will work as a delete key, the 
other arrows are considered control charac- 
ters. And fourth, 1 have a parallel interface 
card in slot 1 of my 'Apple', you may have 
to change the printer routine at 6000 to 
mateh your system. 

I have tried to make this program as user 
friendly as possible and still have it easily 
modifiable. All control characters to printer 
codes are in the subroutine at the end of the 
program. You can have any control character 
be any printer code you want to add. If you 
want to modify the program, but cannot 
follow it contact me for a completely re- 
marked version. 

Epson Label Maker 

10 REM 1" BY 3.5" 

20 REM LABEL MAKER 

30 REM FOR AN EPSON 

40 REM CREATED BY 

50 REM EDWARD L. EASTMAN 

60 REM OCT 1990 

100 HOKE : INVERSE : HTAB 10: 

PRINT "OEPSONOLAHELOMAKERO" : 

NORMAL : PRINT 
110 PRINT "OTHISOOTILITYOISODESIGN 

edOfwOeaseOofOOOdse . OuseOtheOfol 

LOWING OKEYSOFOROTHE" : PRINT 

"correspondingOeffectOonOyoorO 

epson." : print 

120 PRINT "OOKEYOOOOOEFPECT" : 

PRINT "CTRL-SOOSMALLOPRINTO(170 
CPI)" : PRINT "CTRL-LOONLQO (lOO 
CPIOIFOSUPPORTED" : PRINT "CTRL- 
DOODOUBLEOWIDEO (SOCPI) " 

130 PRINT "CTRL-lOOlTALICSO (ALL 
OCPI)" : PRINT "CTRL-BOOBOLDO 
(NOTONLQ)" : PRINT "CTRL-OOUNDER 
LINEOSTART" 

140 PRINT "CTRL-N<»RESETS0DRAFT0 
MC»EO(100CPI)OAND" : HTAB 10: 
PRINT "UNDOESOALLOOTHEROMODES" : 
PRINT 

200 PRINT "OYOUOSHOOLDOALWAYSOIEAVE 

OtheOlastOlineOOblankOtoOallcm 

OFOROTHEOSPACEOBETWEEN" : PRINT 

"LABELS. 
210 PRINT "OYOOOSHOOLDOALSOOKEEP 

OlN0MIND0THATOSCME0tK>DES<k)VER 

RIDEOOTHERS,OCONSOLTOYODR" : 

PRINT "PRINTER' SOMANOAL" 
220 HTAB 8: PRINT "PRESSOANYOKEYO 

TOOCONTINUE" ; : GET A$: PRINT 
230 H«E : INVERSE : HTAB 10: 

PRINT "OEPSONOLABELOMAKERO" : 

NORMAL : PRINT 
240 PRINT "OSELECTOLINESOPEROINCH 

0(600R08):0" ;: GET A$:L - 1:LI 

- 6: IF A$ - "8" THEN LI - 8 
250 PRINT LI: PRINT 

999 REM MAIN LOOP 

1000 vtab 20: print : print "a/ 
zOtoOchangeOlineOnum . OORO • P • Oto 

OPRINT" : PRINT "'ESC'OTOOEXITO 
ORO'RTN'OTOOEDITOLINEO#" L;: GET 

f$ ...... 

1010 IF A$ = "A" OR A$ = CHR$ (97) 
THEN L-L-1: IFL<1 THEN L 

- 1: GOTO 1000 

1020 IF A$ = "Z" OR A$ = CHR$ 

(122) THEN L - L + 1: IF L > LI 

THEN L = LI: GOTO 1000 
1030 IF A$ = CHR$ (13) THEN 2000 
1040 IF A$ = "P" OR A$ = CHR$ 

(112) THEN 6000 
1050 IF A$ = CHR$ (27) THEN PRINT 

: GOTO 6100 
1060 GOTO 1000 

1999 REM EDITING ROUTINE 

2000 VTAB (L + 2) * 2 - 1: HTAB ( 
LEN (Q$(L)) + 1): CST A$ 

2010 IF ,A$ = CHR$ (13) THEN PRINT 

"0" : GOTO 3000 
2020 IP A$ = CHR$ (8) THEN IF LEN 



(Q${L)) - 1 THEN Q$(L) - «" 
2030 IF A$ - CHR$ (8) THEN A$ - "" 
: IF LEN (Q$ (L) > > THEN Q$ (L) 
- LEFT$ (Q$(L), LEN (QS (L) ) - 

1) 
2040 Q$(L) - Q$(L) + A$: PRINT A$; 
"0" : GOTO 2000 

2999 REM PRINT STRING ON SCREEN 

3000 IF Q$(L) = "" THEN Q$(L) - 
"0" 

3010 VTAB (L + 2) * 2 - 1: HTAB 
. 1:LW(L> - 0: FOR X - 1 TO LEN 
(Q$(L)):A$ = MID$ (Q$(L),X,1): 
IF AS < CHR$ (32) THEN GOSOB 
5000 :A$ - CHR$ ( ASC (A$) + 
64) : INVERSE 

3020 PRINT A$;:LW(L) - LW(L) + 
(100 * (D " 1) + 41 * (S = 0) + 
59) * ( PEEK (50) - 255) : 
NORMAL : NEXT 

3030 PRINT "-" LW(L) / 1000 "OIN." 
;: CALL - 868: GOTO 1000 

4999 REM SET CHAR WIDTH FLAGS 

5000 IF A$ - CHR$ (4) THEN D - 1:S 
= 

5010 IF AS = CHRS (14) OR AS - 
CHRS (12) THEN D - 0:S = 

5020 IF AS = CHRS (19) THEN D = 
0:S - 1 

5030 RETURN 

5999 REM PRINT LABELS 

6000 FOR X - 20 TO 24: VTAB X: 
HTAB 1: CALL - 868: NEXT : VTAB 
21: PRINT : INPDT "HCMOMANYO 
LA^LS?" ;F: IF F - THEN 6100 

6010 PRINT : PRINT CHRS (4); 

"PR#1" 
6020 PRINT CHRS (27) CHRS (64); 
6030 PRINT CHRS (27) CHRS (48 + 2 

* (LI - 6)); 
6040 FOR Z - 1 TO F: FOR L = 1 TO 

LI 
6050 FOR X - 1 TO LEN (Q$(L)):AS = 

MIDS (Q$(L),X,1) 
6060 IF AS < CHRS (32) THEN GOSUB 

7000 
6070 PRINT AS;: NEXT : PRINT : 

NEXT : NEXT Z: PRINT CHRS (4) 

"PR#0" 

6099 REM END ROUTINE 

6100 PRINT "MOREOLABELS?0 (Y/N) 0" 
;: GET AS: IF AS - "N" OR AS == 
CHRS (110) THEN END 

6110 PRINT "STARTOFRESH?0(Y/N)0" 
; : GET AS : IF AS = "N" OR AS = 
CHRS (110) THEN FOR X = 21 TO 
24: VTAB X: HTAB 1: CALL - 868: 
NEXT : GOTO 1000 

6120 RUN 230 

6999 REM CTRL-CHAR TURN INTO 
PRINTER CX>DES 

7000 IF AS - CHRS -(2) THEN AS - 
CHRS (27) + CHRS (71) 

7010 IF AS - CHRS (4) THEN AS - 

CHRS (27) + OIRS (14) 
7020 IF AS - CHRS (9) THEN AS = 

CHRS (27) + CHRS (52) 
7030 IF AS » CHRS (12) THEN AS = 

CHRS (27) + CHRS (120) + "1" + 

CHRS (27) + CHRS (107) + "1" 
7040 IF AS - CHRS (14) THEN AS = 

CHRS (27) + CHRS (33) + CHRS 

(0) + CHRS (27) + CHRS (120) + 

"0" 
7050 IF AS = CHRS (19) THEN AS = 

CHRS (27) + CHRS (15) 
7060 IF AS - CHRS (31) THEN AS » 

CHRS (27) + CHRS (45) + "1" 
7070 RETURN - 



lO-SBADD 

20-S9B13 

30-S4O3B 

40-SAD92 

50-$C899 

60-SFF65 

100-$621E 

110-$65FE 

120-$EE8B 

130-S55CB 

140-S2084 

200-55750 

210-S7A9E 

220-SCFDD 

230-S07CE 

240-S54CD 



Checksums 

1030-$B480 
1040-$10E3 
1050-S8193 
1060-$26AD 
1999-SABC3 
2000-S81E6 
2010-$2C44 
2020-$1347 
2030-SCE48 
2040-S78E0 
2999-SDCBF 
3000-S5EC8 
3010-$2283 
3020-57074 
3030-S0AA7 
4999-SEBEB 



6000-S7F2P 

6010-$2C6B 

6020-SC03E 

6030-$5381 

6040-53725 

6050-SCA48 

6060-$DB08 

6070-$52BF 

6099-50965 

6100-SC961 

6110-SE556 

6120-52715 

6999-$ADD6„ 

7000-$DBlF 

7010-$628D 

7020-SEE59, 
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250-$EFDB 5000-$7CD7 7030-$D968 

999-$E782 5010-$F29A 7040-$FB80 

1000-$800B 5020-$CA8B 7050-$78C9 

1010-$A828 5030-$FlA0 7060-$22FB 

1020-$678D 5999-$8252 7070-$F56C 

Note to Personal Newsletter Users 

Trying to eliminate clutter on my desk by 
combining disks, I came across something 
interesting on the back of my Personal 
Newsletter Clip-Art Vol 11 disk. I was in 
Copy 11+ and happened to have the show 
deleted files option going when I spotted ten 
deleted font files. Hmmm. I immediately 
tried Undelete from the menu — no luck. 
However, with a littie persistence I was able 
to recover all of them. 

I noticed after mapping the disk that there 
were exactly enough blocks between exist- 
ing files to allow for the deleted ones. It 
would seem they hadn't been over written 
yet, I wonder why they were not recoverable. 

I became very curious so I went to my 
reference library and pulled out Beneath 
Apple ProDOS (BAP) and started to read. 
Although I am intimately familiar with DOS 
and file structure of 3.3 disks, thanks to 
Beneath Apple DOS, I don't really under- 
stand ProEMDS and its strange blocks from 
sectors arrangement. I did know that one 
Block is equal to two sectors. When a block 
is read in, it actually loads two sectors. 

Knowing what I needed to look into, I 
turned to chapter four on Volumes, Direc- 
tories and Files. There! learned that ProDOS 
is very similar to DOS 3.3 in the way disk 
space and files are kept track of. Most im- 
portantly I learned that a $00 is put over the 
first byte of the file entry upon deletion. This 
byte tells file type and length of the filename. 
I know the fonts are binary, so no problem. 

I used the Zap program from BAP to edit 
the disk blocks with the file names. If you 
don't have a block editor don't worry, 1 
calculated sectors for you to edit. I then tried 
to copy the files from the disk and was met 
unanimously with errors by all my file 
copiers. DOS 3.3 never cared, but ProDOS 
won't let you copy files unless the blocks 
they occupy are marked as used in the VTOC. 
I didn't want to calculate which blocks were 
in use so I marked the entire disk used, what 
a pain. 

In a nutshell, copy the Clip- Art disk side 
B, edit the disk, then copy the files to a data 
disk. Enjoy the fonts that there was room for 
but they just didn't want you to have. 

Changeall of the following: 

COLOSSAL.FNT (trk 0, sec B) 



3 52 00 28 

Block 6 Usage map (trk 0, sec 3) 

Elk B^ Eim le 

6 OO-FF ?? all 00 

This will fix FLOW (trk 8^ec 7) 

E!k Sy!£ Eism la 

44 00 000000 434546 



2 


Bvte 
AO 


Frpni l2 
00 2C 

CYRTILIC.FNT 


Blli 
2 


Bvte 
EE 


From la 
00 2C 


] 


ESPERANTO.FNT (trk 0, 


2 


Bvte 
115 


Frpm l2 

00 2D 
FLOW.FNT 


m 

2 


Byte 
IX 


From l2 
00 28 

GRAPHIC.FNT 


2 


163 


Frpm l2 

00 2B 
GREEK.FNT 


2 


Bvte 
18A 


Frpni l2 
00 29 




KATAKANA.FNT 


2 


1B1 


FrPTi Ifi 

00 2C 




PINOCCHIO.FNT 


2 


1D8 


frpm Ifi 
00 2D 




PUDGY.FNT (trk 0, se 


3 


04 


From Ifi 
00 29 

STOP.FNT 


M 


By!? 


Frpm la 







(Trk 8,Sec 6) 




Elk 


6y1? 
100 


Fjsni 
43 45 46 


lo 

00 0000 


Gary Wills 




Canada 



Boy! Am I looking forward to a Monthly 
Computist! Also, I have a few "Christmas 
Wishes". 

® Has anyone successfully put Omega 
(//e) onto a 3 .5 " disk. I have met with limited 
success. I am able to basically run Omega 
but must use the 5.25" disks when the Re- 
source & Samples directories are needed. I 
had to rename all of the prefixes for the 3.5" 
and put all of the files into subdirectories. 
Unfortunately, when the program searches 
drives for the appropriate disk, it doesn't 
access the subdirectories and, therefore, can ' t 
find the correct file. Even putting ALL of the 
files into ONE subdirectory doesn't seem to 
do the trick. 

©"Where in Time is Carmen Sandi- 
ego?" - Is there any info on how to get more 
time (ie. allotted time + 10 hrs) to solve the 
crimes. My students find it frustrating and 
are not getting into the program as they did 
with "Carmen World". 

©Is there any interest on creating a 
"Robotics Interface", if it were inexpensive/ 
feasible? 

©I have been working on "Test Drive" 
(//e) for the last 3 years! No success. Please 
add it to the "Most Wanted" list. 

©Is there any info on "Chessmaster 
21(X)" (//e)? I have a friend who purchased 
it last year & is afraid of a bomb. 

© I work on a Laser EX (ROM 5.0) and 
have found that The New Print Shop (TNPS) 
is not compatible with it. Friends who own 
the Laser EX/2 do not seem to experience 
these problems. Since I have 2 EX's and the 
problems are identical, it seems to indicate a 
hardware/software glitch. When printing out, 
I am prompted to "Press Return" after every 
3 lines printed. Just imagine printing a 
banner! Although I haven ' t delved too deeply 
into TNPS, I also noticed that the Convert 
utility has a scrambled screen also. 

I would appreciate any and all help! 



Kim Griffith 



CA 



Printing Maps for Under Fire 

If you have ever played Under Fire, you 
have probably noticed that the on-screen 
maps don't always closely match what the 
terrain truly is. Sometimes what is shown 
on-screen doesn't even exist if you check 
the terrain. The map printing routine includ- 
ed on the Under Fire Map Maker disk only 
duplicates what the screen shows, not what 
the terrain actually is. The following pro- 
gram will read the map data from disk and 
print a block type map that will show what 
exists on the map as the computer sees it. 
The program was written for an ImageWrit- 
er II with a color ribbon, compatibility with 
other printers is unknown. 

When the map is printed, hedges will be 
green; stone walls, red; stone buildings, 
dark purple; wood buildings, dark orange; 
water, blue; rough, textured purple; level 1, 
white; level 2, yellow; level 4, light orange; 
roads, black; trees have a green border with 
a green dot in the cento* which allows the 
elevation to be seen inside the green border. 
Buildings, roads, hedges, walls, etc., don't 
indicate elevation because too many differ- 
ent combinations of colors would be neces- 
sary which would make the map too difficult 
to read, thus confusing. The map will give 
you sufficient information so you can check 
more precisely during game play or with the 
Map Maker program. 



Entering the program 

First, get into the monitor and enter the 
machine language code. 

MAPSRC.OBJO 

CALL-151 

7000:4C 5A 74 IB 4B 30 IB 70 $916E 

7008: IB 3E IB 54 31 36 IB 47 $A377 

7010:30 37 33 38 30 31 32 33 $BA34 

7018:34 35 36 IE 05 06 07 75 $26DE 

7020:76 77 90 95 96 97 AO A5 $6AC2 

7028 :A6 A7 BO B5 B6 B7 DO D5 $461E 

7030 :D6 D7 EO E5 E6 E7 FO F5 $D21A 

7038:F6 F7 08 01 71 91 Al Bl $4F45 

7040:D1 El Fl 08 02 72 92 A2 $8671 

7048 :B2 D2 E2 F2 08 03 73 93 $09CA 

7050: A3 B3 D3 E3 F3 08 04 74 $9EBD 

7058:94 A4 B4 D4 E4 F4 08 10 $B44B 

7060:11 12 13 14 15 16 17 08 $AC77 

7068:20 21 22 23 24 25 26 27 $6C47 

7070:08 30 31 32 33 34 35 36 $B336 

7078:37 08 40 41 42 43 44 45 $8AE2 

7080:46 47 08 50 51 52 53 54 $2F02 

7088:55 56 57 08 60 61 62 63 $077E 

7090:64 65 66 67 08 80 81 82 $304F 

7098:83 84 85 86 87 08 CO CI $714B 

70A0:C2 C3 C4 05 C6 C7 FF FF $AE1B 

70A8:FF FF FF FF FF FF FF FF $CE5B 

70B0:FF FF FF FF 7F 7F 7F 7F $2E9B 

70B8:7F 7F 7F 7F 7F 7F 7F 7F $4EDB 

70C0:7F 7F 2A 2A 55 55 2A 2A $6B26 

70C8:55 55 2A 2A 55 55 2A 2A $5B4E 

70D0:7F 7F 41 41 41 41 49 49 $7065 

70D8:41 41 41 41 7F 7F 00 00 $90E7 

70E0:3E 3E 3E 3E 36 36 3E 3E $0C3B 

70E8:3E 3E 00 00 00 00 2A 2A $88DB 

70F0:14 14 2A 2A 14 14 2A 2A $9457 

70F8:00 00 A9 86 85 FF A9 8A $97DD 

7100:85 FB A9 00 85 FE 85 FA $0A00 

7108 :8D CO 89 40 IB 71 BE 00 $A1FB 

7110:01 8E 19 71 A2 01 AO 10 $9AB2 

7118:40 00 01 AO OD 20 OE 71 $0284 

7120:A0 00 B9 03 70 20 2E 71 $9972 

7128:08 CO OB DO F5 60 20 3A $5ADD 

7130:71 AO OF 20 OE 71 20 44 $OD07 

7138:71 60 8D 01 89 8E 02 89 $F01F 

7140:80 03 89 60 AD 01 89 AE $1658 

7148:02 89 AO 03 89 60 A9 80 $0DD3 

7150:85 FD 20 7D 71 60 AO OE $9952 

7158 :A9 FF 91 FE 08 91 FE 98 $1240 

7160:18 69 OF A8 09 OE DO FO $2E3F 

7168:E6 FF A5 FF 09 89 DO E8 $FEBF 

7170:A9 86 85 FF 60 A9 00 85 $1103 

7178:FD 20 7D 71 60 AO 00 A5 $9309 

7180 :FD 91 FE 08 DO FB E6 FF $0E1A 

7188 :A5 FF 09 89 DO EF A9 86 $6344 

7190:85 FF 60 AO 00 B9 OE 70 $3ED0 

7198:20 2E 71 08 CO 06 DO F5 $D903 

71A0:A5 FD 20 2E 71 20 2E 71 $9E86 

71A8:A0 00 Bl FE 20 2E 71 08 $B06E 

71B0:D0 F8 E6 FF A5 FF 09 88 $61D6 

71B8:D0 FO Bl FE 20 2E 71 08 $C746 

7100:00 EO DO F6 A9 OD 20 2E $6E2F 

7108:71 A9 86 85 FF 60 A2 2D $4645 

71D0:AO CO 89 Bl FA 9D DO 89 $7E90 

71D8:CA A5 FA 18 69 40 85 FA $519B 

71E0:D0 Fl E6 FB A5 FB 09 96 $4BFA 

71E8:D0 E9 08 80 00 89 A9 8A $A380 

71F0:85 FB 60 A9 IB 20 2E 71 $B699 

71F8:A9 4B 20 2E 71 8A 20 2E $4BB7 

7200:71 60 20 75 71 AE 15 70 $0A5F 

7208:20 F3 71 A2 60 BD DO 89 $0734 

7210:09 62 DO 06 20 34 74 40 $038B 

7218:2B 72 AO 43 70 D9 43 70 $9DF7 

7220:D0 06 20 FB 73 40 2B 72 $FE24 

7228:88 DO F2 E8 EO 2E DO DD $46CF 

7230 :A9 00 85 FD 20 93 71 20 $B09F 

7238:75 71 AE 16 70 20 F3 71 $90E6 

7240 :A2 00 BD DO 89 09 63 DO $437F 

7248:06 20 47 74 40 71 72 AO $6FD0 

7250:40 70 D9 40 70 DO 06 20 $AC65 

7258:E8 73 40 71 72 88 DO F2 $FD57 

7260:AC 94 70 D9 94 70 DO 06 $6232 

7268:20 FB 73 40 71 72 88 DO $5830 

7270 :F2 E8 EO 2E DO CO A9 00 $B184 

7278:85 FD 20 93 71 20 75 71 $1424 

7280:AE 17 70 20 F3 71 A2 00 $2F28 

7288 :BD DO 89 09 61 DO 06 20 $4D6B 

7290:47 74 40 B7 72 AO 3A 70 $EF97 

7298 :D9 3A 70 DO 06 20 E8 73 $F3DA 

72A0:4C B7 72 88 DO F2 AC 5E $256B 

72A8:70 D9 5E 70 DO 06 20 FB $C8E1 

72B0:73 40 B7 72 88 DO F2 E8 $DB46 

72B8:E0 2E DO CO A9 00 85 FD $4691 



72C0:20 93 71 20 75 71 AE 18 $F1E2 
72C8:70 20 F3 71 A2 00 BD DO $0618 

72D0:89 09 64 DO 06 20 47 74 $1796 

7208:40 OE 73 AC 55 70 D9 55 $2716 

72E0:70 DO 06 20 E8 73 40 OE $659C 

72E8:73 88 DO F2 AC 67 70 D9 $D485 

72F0:67 70 DO 06 20 FB 73 40 $F74D 

72F8:0E 73 88 DO F2 AC 70 70 $60D8 

7300:D9 70 70 DO 06 20 FB 73 $6303 

7308: 40 OE 73 88 DO F2 E8 EO $52D2 

7310 :2E DO BB A9 00 85 FD 20 $36FC 

7318:93 71 20 75 71 AE 19 70 $0902 

7320:20 F3 71 A2 00 BD DO 89 $B4B9 

7328 :AC 8B 70 D9 8B 70 DO 06 $E150 

7330:20 21 74 4C 4A 73 88 DO $CED3 

7338:F2 AC 9D 70 D9 9D 70 DO $920D 

7340:06 20 FB 73 40 4A 73 88 $68B1 

7348:D0 F2 E8 EO 2E DO D6 A9 $0162 

7350:00 85 FD 20 93 71 20 75 $0976 

7358:71 AE lA 70 20 F3 71 A2 $A97D 

7360:00 BD DO 89 AO IB 70 D9 $5F2A 

7368: IB 70 DO 06 20 E8 73 4C $9F7D 

7370:97 73 88 DO F2 AC 79 70 $92B0 

7378:D9 79 70 DO 06 20 FB 73 $608D 

7380:40 97 73 88 DO F2 AO 82 $3867 

7388:70 D9 82 70 DO 06 20 FB $4BB1 

7390:73 4C 97 73 88 DO F2 E8 $ADBE 

7398:E0 2E DO 05 A9 00 85 FD $4DB5 

73A0:20 93 71 20 75 71 AE 14 $8600 

73A8:70 20 F3 71 20 4E 71 20 $A2DD 

73B0:56 71 A2 00 BD DO 89 29 $7875 

73B8:0F 09 08 90 03 20 OE 74 $38BB 

73C0:E8 EO 2E DO EF A9 FF 85 $093B 

7308 :FD 20 93 71 60 8A OA OA $DAA3 

73D0:0A OA 85 FE 8A 4A 4A 4A $E392 

73D8:4A 18 65 FF 85 FF 60 A9 $5B14 

73E0:00 85 FE A9 86 85 FF 60 $83D9 

73E8:20 OD 73 AO 00 B9 02 70 $A9AE 

73F0:91 FE C8 CO OE DO F6 20 $C9EE 

73F8:DF 73 60 20 CD 73 AO 00 $4C6E 

7400 :B9 B4 70 91 FE 08 CO OE $107E 

7408 :D0 F6 20 DF 73 60 20 CD $1B65 

7410:73 AO 00 B9 A6 70 91 FE $D43E 
7418:08 CO OE DO F6 20 DF 73 $D2F6 

7420:60 20 OD 73 AO 00 B9 DO $4F0B 

7428:70 91 FE 08 00 OE DO F6 $F70B 

7430:20 DF 73 60 20 CD 73 AO $B76E 

7438:00 B9 DE 70 91 FE 08 CO $5538 

7440 :0E DO F6 20 DF 73 60 20 $EF44 

7448:CD 73 AO 00 B9 EC 70 91 $450D 

7450 :FE 08 CO OE DO F6 20 DF $0B4A 

7458:73 60 20 FA 70 20 75 71 $21AF 

7460:20 4E 71 A9 OD 20 2E 71 $0AD2 
7468 :A9 80 85 FD 20 93 71 A9 $3916 
7470 :0A 20 2E 71 20 OE 71 20 $AC62 
7478:02 72 A9 OA 20 2E 71 AD $BE3B 
7480:00 89 09 40 DO EE 60 $9B1F 
BSAVE MAPSRC.OBJO, A$7000, L$487 

The Applesoft program will handle the 
rest of the chores. When prompted for the 
map name, don't type any suffixes, just the 
name that has been assigned to the map. 

If anyone has any comments or sugges- 
tions, I can be reached at: 

4916 N.Rio Hondo 
Temple City, CA 91780 

Under Fire Mapper 

FP 

10 IF PEEK (28672) = 76 THEN 30 
20 PRINT OHR$ (4) ; "BLOADOMAPSRC. 

OB JO" 
30 INPUT "ENTERONAMEOOFOMAPOTOO 

PRINTO:" ;N$ 
40 PRINT OHR$ (4) ; "BLOADO" ;N$; 

"'.DAT,A$8A00" 
45 CALL 28672 
50 INPUT "PRINT0s)AME0/0D)IFFERENT0 

/0Q)UIT0" ;A$ 
60 IF A$ = "S" THEN 45 
70 IF A$ = "D" THEN 30 
80 IF A$ < > "Q" THEN 50 
90 END 
SAVE UNDER FIRE MAPPER 



Checksums 

10-$AE5F 45-$6B78 

20-$62B9 50-$8575 

30-$9E14 60-$8407 

40-$3A61 70-$B3E7 



80-$26C9 
90-$35F5 
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MAPSRC Source Code 

•MAPSRC — Prints Under Fire block terrain maps 
"" PUT EQUs HERE"" 

MAPPTR EQU $FA pointer to map data 

TMPSAV EQU $FD ;Temporary storage 

BUFPTR EQU $FE ;Pointer to printer data 

COLDAT EQU $89D0 ;Map column data buffer (L$,2E) 

COLCTR EQU $89C0 :Map column counter 
ASAVE EQU $89C1 ;Accumulator save location 

XSAVE EQU $89C2 ;X register save location 

YSAVE EQU $8903 ;Y register save location 

""START HERE**" 

ORG $7000 
•"• JUMP TO MAIN PROGRAM "" 

JMP MAINPROG 
•"•DATA HERE"" 
INITDATA DFB $1B,$4B,$30 ;Blackcode 

DFB $1B,$70 ;144 DPI code 

DFB $1B,$3E :Unl-directional 

DFB $1B,$54,$31,$36 ;Set line feed to 16/144 Inch 
GRFXDATA DFB $1B,$47 ;Graphics command 

DFB $30,$37,$33,$38 ;Numberofbytes to print 
BLACK DFB $30 ;BLACKcode 

YELLOW DFB $31 ;YELLOWcode 

MAGENTA DFB $32 iMAGENTAcode 

CYAN DFB $33 ;CYANcode 

ORANGE DFB $34 ;ORANGEcode 

GREEN DFB $35 ;GREEN code 

PURPLE DFB $36 ;PURPLEcode 

;Map byte values: 
ROUGHDAT DFB $1 E,$05,$06,$07,$75,$76,$77 

DFB $90,$95,$96,$97,$A0,$A5,$A6,$A7 
DFB $B0,$B5,$B6,$B7,$D0,$D5;$D6,$D7 
DFB $E0,$E5,$E6,$E7,$FO,$F5,$F6,$F7 
OPENODAT DFB $08,$01,$71,$91,$A1,$B1,$D1,$E1,$F1 
0PEN2DAT DFB $08,$02,$72,$92,$A2,$B2,$D2,$E2,$F2 
0PEN3DAT DFB $08,$03,$73,$93,$A3,$B3,$D3.$E3,$F3 
0PEN4DAT DFB $08,$04,$74,$94,$A4,$B4,$D4,$E4,$F4 
WATERDAT DFB $08,$10,$11,$12,$13,$14,$15,$16,$17 
WDBLD1DAT DFB $08,$20,$21,$22,$23,$24,$25,$26,$27 
WDBLD2DAT DFB $08,$30,$31,$32,$33.$34,$35,$36,$37 
STBLD1DAT DFB $08,$40,$41,$42,$43,$44,$45,$46,$47 
STBLD2DAT DFB $08,$50,$51,$52,$53.$54,$55,$S6,$S7 
WOODSDAT DFB $08,$60,$61,$62,$63,$64,$65,$66,$67 
STNWALDAT DFB $08,$80,$81,$82,$83,$84,$85,$86,$87 
HEDGEDAT DFB $08,$C0,$C1,$C2,$C3,$C4,$C5,$C6,$C7 
;Graphics byte values for printer: 

SQROAD DFB %11111111,%11111111,%11111111,%11111111 
DFB %11111111,%11111111,%11111111,%11111111 
DFB %11111111,%11111111,%11111111,%11111111 
DFB %11111111,%11111111 
SQSOLID DFB %01111111,%01111111,%01111111,%01111111 
DFB %0ri11111,%01111111,%01111111,%01111111 
DFB %01111111,%01111111,%01111111,%01111111 
DFB %01111111,%01111111 
SQDOTTED DFB %00101010,%00101010,%01010101,%01010101 
DFB %001 01 01 0,%001 01 01 0,%01 01 01 01 ,%01 01 01 01 
DFB %00101010,%00101010,%01010101,%01010101 
DFB %00101010,%00101010 
SQBORDER DFB %01 1 1 1 1 1 1 ,%01 1 1 1 1 1 1 ,%01 000001 ,%01 000001 
DFB %01 000001 , %01 000001 ,%01 001 001 ,%01 001 001 
DFB %01 000001 ,%01 000001 ,%01 000001 ,%01 000001 
DFB %01111111,%01111111 
SOCENTER DFB %00000000,%00000000,%00111110,%00111110 
DFB %001 1 1 1 1 0,%001 1111 0,%001 1011 0,%001 10110 
DFB %00111110,%00111110,%00111110,%00111110 
DFB %00000000,%00000000 
SQDOTCENT DFB %00000000,%00000000,%00101010,%00101010 
DFB %00010100,%00010100,%00101010,%00101010 
DFB %00010100,%00010100,%00101010,yo00101010 
DFB %00000000,%00000000 
*"• SUBROUTINE TO INITIALIZE RAM LOCATIONS •"* 
START LDA #$86 

STA BUFFPTR+1 ;BUFPTR points to $8600 
LDA «$8A 

STA MAPPTR+1 iMAPPTR points to $8A00 
LDA #$00 
STA BUFFPTR 
STA MAPPTR 

STA COLCTR ;Column counter Is zero 

ilNITIALIZE PRINTER 

JMP BEGIN 
GOCARD LDX $C100,Y ;Get lo byte of ent^ point 

STX VECTOR+1 iSelf modifying code 
LDX #$C1 Required; X = Cn 

LDY #$10 ;Requlred;Y=nO 

VECTOR JMP $C100 ;Thls address gets modified 

BEGIN LDY #$0D ;lnltlallze.... 

JSR GOCARD ;.,card 
LDY #$00 ilnit counter 

DATALOOP LDA INITDATA.Y ;Black, 144 DPI, uni-dlr., line feed 
JSR SENDBYTE ;Save registers 
INY ;lncrement counter 

CPY #$0B ;Have air bytes been sent? 

BNE DATALOOP ;lf not, do again 
RTS iReturn 

*"• SUBROUTINE TO SEND BYTE TO PRINTER •"• 
SENDBYTE JSR SAVEREGS ;Save registers 
LDY #$0F iNecessary 

JSR GOCARD ;Send byte to card 
JSR RESTREGS ;Restore registers 
RTS 
•"• SUBROUTINE TO SAVE REGISTERS **" 
SAVEREGS STA ASAVE ;Save accumulator 
STX XSAVE iSaveX register 



STY YSAVE 
RTS 



iSave Y register 



*"• SUBROUTINE TO RESTORE REGISTERS "•• 
RESTREGS LDA ASAVE jRestore accumulator 
LDX XSAVE iRestore X register 
LDY YSAVE ;Restore Y register 
RTS 
"" SUBROUTINE TO PUT NORTH-SOUTH LINE IN BUFFER ■"• 
NSLINE LDA #%1 0000000 ;Value for printer 

STA TMPSAV ;Put it where BUFFILL can find It 

JSR BUFFILL ;Go fill the buffer 

RTS 
•••• SUBROUTINE TO PUT EAST-WEST LINES IN BUFFER *"• 
EWLINES LDY #$0E ilnltiallze for offset Into buffer 

LOOPEW LDA #%11111111 iValue for E-W map lines 
STA (BUFFPTR),Y ;Put It In buffer 
INY ilncrement offset 

STA (BUFFPTR),Y ;Put It in buffer again 
TYA ;lncrement Y reg OF times: 

CLC 

ADC #$0F ;Add OF 

TAY 

CMP#$OE ;lsYregOEyet? 

BNE LOOPEW ;lf not, do another 
INC BUFFPTR+1 increment hi byte of pointer 
LDA BUFFPTR+1 :6et hi byte of pointer 
CMP #$89 ;b it (page) 89? 

BNE LOOPEW :lfnot, then less. Do it again 
LDA #$86 ;Restore pointer in zero page 

STA BUFFPTR+1 
RTS iReturn 

"** SUBROUTINE TO ZERO PRINTER BUFFER "" 
ZEROBUFF LDA #$00 ;Get 00 value 

STA TMPSAV iStore it where BUFFILL can find it 
JSR BUFFILL ;Fill the buffer with it 
RTS iRetum 

•••• SUBROUTINE TO FILL BUFFER WITH VALUE IN TMPSAV •*" 
BUFFILL LDY #$00 ;lnlt counter for index into buffer 

LDA TMPSAV ;Value to fill buffer with 
L00P1 STA (BUFFPTR),Y ;Put it in buffer 

INY ;lncrement counter 

BNE L00P1 ;Do again until page Is full 

INC BUFFPTR+1 ;lncrement MSB of pointer 
LDA BUFFPTR+1 ;Get MSB of pointer 
CMP #$89 lis It 89? 

BNE BUFFILL :lf not, then It's less; do^agaln 

LDA #$86 

STA BUFFPTR+1 iRestore pointer In zero page 
RTS ;Ftetum 

*"* SUBROUTINE TO SEND PRINTER BUFER TO PRINTER "" 
PRINTBUFF LDY #$00 ;lnltiallze counter 

jFirst, set up to print a line of graphics: 
GRFXLOOP LDA GRFXDATA,Y ;Getabyte 

JSR SENDBYTE ;Send the byte 
INY • ' ;lncrement counter ' 

CPY #$06 ;Have 06 bytes passed? 

BNE GRFXLOOP :lf not, get another 
;Now send 738 graphics bytes to the printer: 

LDA TMPSAV ;Get value for first two bytes 

JSR SENDBYTE ;Sendit.... 
JSR SENDBYTE ;..twice 
LDY #$00 ;lnltlalize counter to send a page 

L00P2 LDA (BUFFPTR),Y ;Get byte from buffer 

JSR SENDBYTE ;Send the byte 
INY ilncrement counter 

BNE L00P2 ;lf page not done yet, do again 

INC BUFFPTR+1 ;lncrement page 
LDA BUFFPTR+1 ;Getpage 
CMP #$88 :1s it 88? 

BNE L00P2 ;lf not, do another page 

LOOPS LDA (BUFFPTR),Y ;Get byte from buffer 

JSR SENDBYTE ;Send the byte 
INY ilncrement counter 

CPY #$E0 iHave EO bytes passed? 

BNE LOOPS ;lf not, get another byte 

LOA #$0D iCARRIAGE RETURN 

JSR SENDBYTE ;Send It to printer 
LOA #$86 iRestore pointer In zero page 

STA BUFPTR+1 
RTS ;Return 

"" SUBROUTINE TO GET MAP COLUMN DATA & PUT IN COLUMN 

BUFFER *"• 
GETMAPCOL LDX #$2D iFor index Into COLDAT 

LDY COLCTR iFor use as column offset In map data 
L00P4 LDA (MAPPTR),Y iGet map byte 

STA COLDAT.X iPutlnbuffer(hitolo) 
DEX iDecrement Index Into buffer 

LDA MAPPTR iGet lo byte of map pointer 
CLC 

ADC #$40 liner, map buffer pointer by 1 map row 

STA MAPPTR iStore it at proper location 
BNE L00P4 |lf note (4 nsws done), do another row 
INC MAPPTR+1 ilncrement hi byte of map pointer 
LDA MAPPTR+1 iGet hi byte of map pointer 
CMP #$96 lis It 96? 

BNE L00P4 |lf not, go do another page 
INY ilncrement column number 

STY COLCTR iSave it at proper location 
LDA #$8A 

STA MAPPTR+1 iRestore map pointer In zero page 
RTS 
"" SUBROUTINE TO SET COLOR TO VALUE IN X REG "" 
COLOR LDA #$1B iSend two necessary bytes: 

JSR SENDBYTE 
LDA #$4B 



JSR SENDBYTE 

TXA iGet color code 

JSR SENDBYTE iSend color byte 
RTS 
*"* SUBROUTINE TO PRINT ALL COLORS FROM CURRENT COLUMN "*• 
lYELLOW starts here 

PRINTCOL JSR ZEROBUFF iRrst, zero the buffer 
LDX YELLOW iGet value for YELLOW 

JSR COLOR iSet printer to YELLOW 

LDX #$00 ilnltlalize Index Into COLDAT 

YELLOWLOOP LDA COLDAT,X iGetabyte 
iCheck for map level 2 WOODS (62), CENTER YELLOW 

CMP #$62 lb It level 2 WOODS? 

BNE CHK0PEN2 |lf not, check level 2 OPEN 
JSR FILLCENTER ill's Ivl 2 WOODS, fill center of square 
JMP NXTYELLOW |Go do another square 
iCheck for map level 2 OPEN, SOLID YELLOW 
CHK0PEN2 LDY.0PEN2DAT iGet counter for loop ' 
L00P0PEN2 CMP 0PEN2DAT,Y iCompare with byte In table 
BNE NXTBYTE2 |lf not the same, do another 
JSR FILLSOLID ilfs level 2 OPEN, fill solid square 
JMP NXTYELLOW |Go do another square 
NXTBYTE2 DEY iDecrement counter 

BNE L00P0PEN2 |lf not 0, get another byte from table 
NXTYELLOW INX ilncrement index into COLDAT 

CPX #$2E iHave 2E bytes been checked? 

BNE YELLOWLOOP ilf not, do another 
LDA r/oOOOOOOOO iValue for first two graphics bytes 
STA TMPSAV iPut it where PRINTBUFF can find It 

JSR PRINTBUFF iSend graphics code, then printer data 
iMAGENTA starts here 

JSR ZEROBUFF iFirst, zero the buffer 
LDX MAGENTA iSet value for MAGENTA 
JSR COLOR iSet printer to MAGENTA 

LDX #$00 Ilnltiallze index into COLDAT 

MAGENTALOOP LDA COLDAT,X iGetabyte 
iCheck for map level 3 WOODS (63), CENTER DOHED MAGENTA 
CMP #$63 lb It level 3 WOODS? 

BNE CHK0PEN3 |lf not, check level 3 OPEN 
JSR FILLDOTCNT ih's level 3 WOODS, fill dotted center 
JMP NXTMAGENTA iGo do another square 
iCheck for map level 3 OPEN, SOLID DOTTED MAGENTA 
CHK0PEN3 LDY 0PEN3DAT iGet counter for loop 
L00P0PEN3 CMP 0PEN3DAT,Y iCompare with byte in table 
BNE NXTBYTE3 ilf not the same, do another 

JSR FILLDOHED ilt's level 3 OPEN, fill dotted square 
JMP NXTMAGENTA iGo do another square 
NXTBYTE3 DEY iDecrement counter 

BNE L00P0PEN3 ilf not 0, get another byte from table 
iCheck for STONE WALL ($80.$87) 

LDY STNWALDAT iGet counter for loop 
LOOPSW CMP STNWALDAT.Y iCompare with byte In table 
BNE NXTBYTESW |lf not the same, do another 
JSR FILLSOLID ilt's STONE WALL, fill solid square 

JMP NXTMAG0JTA iGo do arrather square 
NXTBYTESW DEY iDecrement counter 

BNE LOOPSW ilf not 0, get another byte from table 

NXTMAGENTA INX ilncrement Index into COLDAT 

CPX #$2E iHave 2E bytes passed yet? 

BNE MAGENTALOOP ilf not, do another 
LDA r/oOOOOOOOO iValue for first two graphics bytes 
STA TMPSAV iPut it where PRINTBUFF can find it 

JSR PRINTBUFF iSendgraphicscode, then printer data 
iCYAN starts here 

JSR ZEROBUFF iFlrst, zero the buffer 
LDX CYAN iSet value for CYAN 

JSR COLOR iSet printer to CYAN 

LDX #$00 ilnltiallze index into COLDAT 

CYANLOOP LDA COLDAT,X iGetabyte 
iCheck for map level WOODS (61), CENTER DOTTED CYAN 
CMP #$61 lb it level WOODS? 

BNE CHKOPENO |lf not, check level OPEN 
JSR FILLDOTCNT ih's Ivl WOODS, fill center of square 
JMP NXTCYAN iGo do another square 
iCheck for map level OPEN. SOLID DOTTED CYAN 
CHKOPENO LDY OPENODAT iGet counter for loop 
LOOPOPENO CMP OPENODAT.Y iCompare with byte in table 
BNE NXTBYTEO |lf not the same, do another 
JSR FILLDOTTED ilt's level 2 OPEN, fill solid square 
JMP NXTCYAN iGo do another square 
NXTBYTEO DEY iDeaement counter 

BNE LOOPOPENO |lf not 0, get another byte from table 
iCheck for WATER (10.1 7), SOLID CYAN 

LDY WATERDAT iGet counter for loop 
LOOPWATER CMP WATERDAT,Y iCompare with byte in table 
BNE NXTWATER ilf not the same, do another 
JSR FILLSOLID ilt's WATER, fill solid square 
JMP NXTCYAN |Go do another square 
NXTWATER DEY iDecrement counter 

BNE LOOPWATER |lf not 0, get another byte from table 
NXTCYAN INX ilncrement Index Into COLDAT 

CPX #$2E |Have2E bytes been checked? 

BNE CYANLOOP |lf not, do another 
LOA r/oOOOOOOOO iValue for first two graphics bytes 
STA TMPSAV iPut It where PRINTBUFF can find It 

JSR PRINTBUFF iSend graphics code, then printer data 
lORANGE starts here 

JSR ZEROBUFF iFirst, zero the buffer 
LDX ORANGE iSet value for ORANGE 
JSR COLOR iSel printer for ORANGE 

LDX #$00 ilnltiallze index into COLDAT 

ORANGELOOP LDA COLDAT,X iGet a byte 
iCheck for level 4 WOODS (64), CENTER DOTTED ORANGE 
CMP #$64 lb it level 4 WOODS? 

BNE CHK0PEN4 ilf not, check for level 4 OPEN 
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JSR FLLDOTCNT .It's M 4 WOODS, fill center of square 
JMP NXTORANGE :Go check next square 



BLACKLOOP LOA COLDAT.X iGetabyte 

;Check for ROAD (lo nibble x8 or greater), SOLID BLACK 



;Ctieck fbf level 4 OPEN (from LVL4DATA) 




AND #$0F 


Mask off hi nibble 


CHK0PEN4 


LDY 0PEN4DAT 


Get counter for loop 




CMP #$08 




L00P0PEN4 


CMP 0PEN4DAT.Y ; 


Compare with byte in table 




BCC NXTBLACK 


If less than 08, check next ten^in 




BNE NXTBYTE4 ; 


If not the same, do another 




JSR FILLROAD 


It's road, fill solid square 




JSR FllinonED ; 


rs level 4 OPEN. 1 solid square 


NXTBLACK 


INX 


Increment index into COLDAT 




JMP NXTORANGE ; 


Go do another square 




CPX #$2E 


Have 2E bytes been checked? 


NXTBYTE4 


DEY 


[)ecrement counter 




BNE BUCKLOOP 


If not, do another 




BNE L0OPOPEN4 


If not 0, get another byte from table 




LDA #%11111111 


Value for first two graphics bytes 


:Check for 1 STORY WOODEN BUILDING {$20.$27) 




STA TMPSAV 


Put it where PRINTBUFF can find it 




LDY WDBLD1DAT 


Get counter for loop 




JSR PRINTBUFF 


Send graphics code, then printer data 


W00DL00P1 


CMP WDBLDIDAT.Y ; 


Compare with byte in table 




RTS 


Return 




BNE NXTWBLD1 


If not the same, do another 


"" SUBROUTINE TO GET PRINTER BUFFER POINTER **" 




JSR FILLSOLID ; 


It's 2 ST WOOD BLDG, fill solid 


GETBUFFPTR TXA 


Get offset Into column buffer 




square 




ASL 


Multiply by 10: 




JMP NXTORANGE 


Go do another square 




ASL 




NXTWBLD1 


DEY 


Decrement counter 




ASL 






BNE W00DL00P1 


If not 0. get another byte from table 




ASL 




;Ctieck for 2 STORY WOODEN BUILDINC 


3($30.$37) 




STA BUFFPTR 


Put in lo byte of pointer 




LDY WDBLD2DAT 


Get counter for loop 




TXA 


Get the offset again 


W00DL00P2 


CMP WDBLD2DAT.Y 


Compare with byte in table 




LSR 


Divide by 10: 




BNE NXTWBLD2 


If not the same, do another 




LSR 






JSR FILLSOLID 


It's 1ST WOOD BLDG, fill solid 
•quare 




LSR 
LSR 






JMP NXTORANGE 


Go do another square 




CLC 




NXTWBLD2 


DEY 


l}ecrement counter 




ADC BUFFPTR+1 


Add page offset to hi byte of pointer 




BNE W00DL00P2 


If not 0, get another byte from table 




STA BUFFPTR+1 


Store it in hi byte of pointer 


NXTORANGE 


INX 


Increment Index into COLDAT 




RTS 






CPX #$2E 


Have 2E bytes been checked? 


"" SUBROUTINE TO RESTORE PRINTER BUFFER POINTER "" 




BNE ORANGELOOP 


If not, do another 


RESTPTR 


LDA #$00 






LDA #%00000000 


Value for first two graphics bytes 




STA BUFFPTR 


Restore lo byte 




STA TMPSAV 


Put It where PRINTBUFF can find It 




LDA #$86 






JSR PRINTBUFF 


Send graphics code, then, printer data 




STA BUFFPTR+1 


Restore hi byte 


;GREEN starts here 






RTS 






JSR ZEROBUFF 


First, zero the buffer 


"" SUBROUTINE TO FILL DOTTED SQUARE "" 




LDX GREEN 


Set value for GREEN 


Fll 1 DOHED 


JSR GETBUFFPTR 


Get buffer pointer 




JSR COLOR 


Set printer for GREEN 




LDY #$00 


Initialize the pointer offset 




LDX #$00 


Initialize index into COLDAT 


LOOPDOI IbD LDA SQDOnED,Y 


Get a byte from table 


GREENLOOP 


LDA COLDAT.X 


Get a byte 




STA (BUFFPTR),Y 


Put it in buffer 


;Check for WOODS (60.67) 






INY 


Increment offset from pointer 




LDY WOODSDAT 


Get counter for loop 




CPY #$0E 


Have OE (14) bytes passed yet? 


LOOPWOODS CMP WOODSDAT.Y 


Compare with byte in table 




BNE LOOPDOTTED 


If not go do another 




BNE NXTWOODS 


If not the same, do another 




JSR RESTPTR 


Restore pointer 




JSR Fill BORDER 


h's WOODS, fill border square 




RTS 


Return 




JMP NXTGRFFN 


Go do another square 


**" SUBROUTINE TO FILL SOLID SOU/ 


flE"" 


NXTWOODS 


DEY 


Deaement counter 


FILLSOLID 


JSR GETBUFFPTR 


Get buffer pointer 




BNE LOOPWOODS 


If not 0, get another byte from table 




LDY #$00 


Initialize the pointer offset 


;Check for HEDGE ($60.$67) 




LOOPSOLID 


LDA SQSOLID,Y 


Get a byte from table 




LDY HEDGEDAT 


Get counter for loop 




STA (BUFFPTR),Y 


Store It in printer buffer 


LOOPHEDGE 


CMP HEDGEDAT.Y 


Compere with byte In table 




INY 


Increment offset 




BNE NXTHEDGE 


If not the same, do another 




CPY #$0E 


Have OE (14) bytes passed? 




JSR FILLSOLID 


h's HEDGE, fill solid square 




BNE LOOPSOLID 


If not, do another 




JMP NXTGREEN 


Go do another square 




JSR RESTPTR 


Restore l^ffer pointer 


NXTHEDGE 


DEY 


Decrement counter 




RTS 


Return 




BNE LOOPHEDGE 


If not 0, get another byte fivm table 


"" SUBROUTINE TO FILL ROAD SQUA 


iRE"" 


NXTGREEN 


INX 


Increment index into COLDAT 


FILLROAD 


JSR GETBUFFPTR 






CPX #$2E 


Have 2E bytes been checked? 




LDY #$00 






BNE GREENLOOP 


If not, do another 


LOOPROAD 


LDA SQROAD,Y 






LDA #%00000000 


Value for first two graphics bytes 




STA (BUFFPTR),Y 






STA TMPSAV 


Put it where PRINTBUFF can find it 




INY 






JSR PRINTBUFF 


Send graphics code, then printer data 




CPY #$0E 




PURPLE starts here 






BNE LOOPROAD 






JSR ZEROBUFF 


Rrst, zero the buffer 




JSR RESTPTR 






LDX PURPLE 


Set value for PURPLE 




RTS 






JSR COLOR 


Set printer to PURPLE 


"" SUBROUTINE TO FILL BORDER OF 


SQUARE"" 




LDX #$00 


Initialize Index into COLDAT 


FILLBORDER 


JSR GETBUFFPTR 


Get buffer pointer 


PURPLELOOP IDA COLDAT.X 


Get a byte 




LDY #$00 


Wtialize the pointer offset 


;Check for ROUGH. DOHED PURPLE 




L00P60RDERLDA SQBORDERY 


Get a byte from table 




LDY ROUGHDAT 


Get counter for hx>p 




STA (BUFFPTR),Y 


Store it in printer buffer 


L00P14 


CMP ROUGHDAT.Y 


Compare with byte In table 




INY 


Increment oftset 




BNE NXTROUGH 


If not the same, do another 




CPY #$0E 


Have OE (14) bytes passed yet? 




JSR FLLDOHED 


k's ROUGH, fill dotted square 




BNE LOOPBORDER 


If not, do another 




JMP NXTPURPLE 


Go do another square 




JSR RESTPTR 


Restore buffer pointer 


NXTROUGH 


DEY 


Decrement counter 




RTS 


Return 




BNE L00P14 


If not 0, get another byte from table 


•"* SUBROUTINE TO FILL CENTER OF 


SQUARE"" 


;Check for 1 STORY STONE BUILDING ( 


$40.$47) 


FILLCENTER 


JSR GETBUFFPTR 


Get buffer pointer 




LDY STBiniDAT 


Get counter for loop 




LDY #$00 


Initialize pointer offset 


L00PSBLD1 


CMP STBLD1DAT.Y 


Compare with byte In table 


LOOPCENTER LDA SOCENTER,Y 


Get a byte from table 




BNE NXTSBLD1 


If not the same, do another 




STA (BUFFPTR),Y 


Store it in printer buffer 




JSR FILLSOLID 


It's 1SSTN BLDG, fill solid square 




INY 


Increment offset 




JMP NXTPURPLE 


Go do another square 




CPY #$0E 


Have 14 bytes passed? 


NXTSBLD1 


DEY 


Decrement counter 




BNE LOOPCENTER 


If not, go do another 




BNE L0OPSBLD1 


If not 0, get another byte from table 




JSR RESTPTR 


Restore buffer pointer 


;Check for 2 STORY STONE BUILDING ( 


$50.$57) 




RTS 


Return 




LDY STBLD2DAT 


Get counter for k)op 


•••• SUBROUTNE TO FILL DOHED CEt 


ITER OF SQUARE"" 


LOOPRW n2 


CMP STBLD2DAT.Y 


Compare with byte In table 


FILLDOTCNT 


JSR GETBUFFPTR 


Get buffer pointer 




BNE NXTSBLD2 


If not the same, do another 




LDY #$00 


Initialize pointer offset 




JSR FLLSaiD 


It's 2 S STN BLDG, fill solid square 


LOOPDOTCNT LDA SQDOTCENT,Y 


Get a byte from table 




JMP NXTPURPLE 


Go do another square 




STA (BUFFPTR),Y 


Put It in buffer 


NXTSBLD2 


DEY 


.Deaement counter 




INY 


Increment offeet 




BNE L00PSBLD2 


If not 0. get another byte from table 




CPY #$0E 


Have 14 bytes passed? 


NXTPURPLE 


INX 


Increment index into COLDAT 




BNE LOOPDOTCNT 


If not, go do another 




CPX #$2E 


Have 2E bytes been checked? 




JSR RESTPTR 


Restore buffer pointer 




BNE PURPLELOOP 


If not, do another 




RTS 


Return 




LDA #%00000000 


Value for first two graphics bytes 


"" MAIN PROGRAM STARTS HERE "' 


• 




STA TMPSAV 


Put it where PRINTBUFF can find it 


MAINPROG 


JSR START 


Initialize pointers, printer 




JSR PRINTBUFF 


Send graphics code, then printer data 




JSR ZEROBUFF 


Zero the printer buffer 


;BLACK starts here 






JSR NSLINE 


Put north-south line in buffer 




JSR ZEROBUFF 


First, zero the buffer 




LDA #$0D 


CARRIAGE RETURN 




LDX BLACK 


Get value for BUCK 




JSR SENDBYTE 


Send it to printer 




JSR COLOR 


Set printer to BLACK 




LDA #%1 0000000 


Value for first two graphics bytes 




JSR NSLINE 


Put north-south line in buffer 




STA TMPSAV 


Put it where PRINTBUFF can find it 




JSR EWLINES 


Put east-west lines in buffer 




JSR PRINTBUFF 


Send graphics code, then printer data 




LDX #$00 


Initialize index into COLDAT 




LDA #$0A 


LINE FEED 



JSR SENDBYTE 
MAINLOOP JSR GETMAPCOL 

JSR PRINTCOL 
LDA #$0A 
JSR SENDBYTE 
LDA COLCTR 
CMP #$40 
BNE MAINLOOP 
RTS 

Suzanne R. Harvey 



;Send it to printer 

;Get map column of data, store at 

COLDAT 

;Print all colors for the column 

;LINE FEED 

;Send it to printer 

:Get number of column just printed 

;ls it 3F (64th column)? 

;lf not, do another 

lALLDONEI 



AZ 



©I have been playing Wizardry V: The Heart of the 
Maelstrom for several months but I have now reached an 
impasse. I would appreciate any help that your readers could 
give me. 

I think I missed several things on the way to Level 7. Is 
there any significance to the runes which are found on each 
level? 

Level 3 

1) A friend told me which buttons to press on the 
Paradimensional Etherealizer. If you try to discover the 
right buttons by trial and error, it could take a long time. Is 
there any clue in the game that tells you which are the right 
buttons? 

2) Is there any significance to the rooms hung with 
colored curtains? 

Level 5 

1) When my party entered the Playhouse Mystery The- 
atre, they fell into a pit at a four-way intersection. There ate 
four rooms here, all the same, and I could not find any way 
out What is the purpose of these rooms and is there a way 
out? 

2) My party could not get through the doors on the sides 
of the Mad Room; whenever they got close, they were 
teleported away. Is there a way to stop the teleportations and 
get through the doors? 

Level 6 

1) Where is Evil Eyes? My party was unable to find him 
even after three hours of real time searching. 

Level 7 

1) I have found the four staffs and threeof the four cards. 
Where is the Ace of Clubs? 

2) I have discovered the names of two of the Divine 
Aspects: TIME and NATURE. A friend told me the third 
Aspect is KINGDOM. Where do you discover this? 

3) I am presently at the colored flames at the center of 
Level 7. 1 haven'tbeen able to discover what to do here. Can 
anyone help me? 

Advanced Playing Technique for... 
Wizardry V 

Sir Tech 

In playing Wizardry V, I ran into several frustrating 
circumstances which included the untimely demise of sev- 
eral members of my party. It seemed that a little disk 
snooping was in order to remedy the situation. I thought the 
information I discovered would be of interest to some of 
your readers. 

The Wizardry V characters are stored on Disk A, track 4, 
beginning at sector 7 and going down. Each character takes 
up about three-quarters of a sector (246 bytes) and then the 
next character begins. This means a particular piece of 
information for two different characters will not appear in 
the same byte relative to the start of a sector but it will appear 
in the same byte relative to the startof the character's record. 
Each character' s record starts one byte before his name. The 
locations listed below are relative to this first byte. 
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Character data 


dec 


hex 


contenLs/meanine 


1 


01 


Number of bytes in character's name 


2-31 


02- IF 


Character's name 


33 


21 


Race 


35 


23 


Class 


37 


25 


Alignment 


39 


27 


Sex 


41 


29 


Status 


43-44 


2B-2C 


Age 


45-48 


2D-30 


Attributes 


53-57 


35-38 


Gold 


59 


3B 


Number of items carried 


61-91 


3D-5B 


Items carried and their status 


93-97 


5D-60 


Experience points 


99-100 


63-64 


Current level 


101-102 


65-66 


Maximum level 


103-104 


67-68 


Current hit points 


105-106 


69-6A 


Maximum hit points 


107-110 


6B-6E 


Mage spells 


111-114 


6F-72 


Priest spells 


115-121 


73-79 


Mage spell points 


123-129 


7B-81 


Priest spell points 


133-134 


85-86 


Armor class 

C0MPUT1ST#77 



163-164 A3-A4 Maiks 

193 CI Swim counter 

Some of this information is stored in a straightforward 
manner and some is stored very strangely indeed. 



Race Class 


AlKjnment 


SSI 




Status 


01 • Human 00 « fighter 


01 = 


= good 


01 = 


male 


00 = OK 


02 = Elf 01 = mage 


02: 


> neutral 


02 = 


female 


01= OK 


03 = Dwarf 03 = priest 


03 = 


■ evil 






02 = slept 


04 = Gnome 04 = bishop 










03== paralyzed 


05:=Hobbit OS^samura 


i 








04 = petrified 


06 = lord 










05 = dead 


07 = ninja 










06 = ashes 

07 = lost 



Age 

Age is stored in a two-byte lo/hi format. Divide the stored 
number (in hex) by $34 to find the age. Be aware that there 
is a range of values which all give the same age when 
divided by $34. Therefore the stored values for the ages of 
two characters may be different, even though their displayed 
ages are the same. 



Attributes 






The six attributes are stored in four bytes. 




To raise this attribute by 1 gdd 


10 byte 


! (hex) 




STRENGTH 


$01 


45 


($2D) 


IQ 


$20 


45 


($2D) 


PIETY 


$04 


46 


($2E) 


VITALITY 


$01 


47 


($2F) 


AGILITY 


$20 


47 


($2F) 


LUCK 


$04 


43 


($30) 


To have all attributes at 18: 








Byte location 45($2m 46f$2B 


47($2n 


48 ($30) 


Value 52 4A 




52 


4A 



Mage spells 

Mage Spells are stored in four bytes. 

MMsi mmo. mma mim. meaning 

FE 3F 00 00 All spells LI - L3 

FF FF 7F 00 All spells LI - L5 

FF FF FF FF All spells LI - L7 

Priest spells 

Priest Spells are stored in four bytes. 

111($6R 112 ($701 113 ($711 114 ($72) meaning 

FF FF FF OE All spells L1-L6 (ex- 

cept Liktofeit) 

FF FF FF OF All spells LI - L6 



FF 



FF 



FF 



FF 



All Spells LI - L7 



Armor class 

Armor Class is stored in two bytes. If the armor class is 
positive. Byte 134 ($86) = 00 and Byte 135 ($87) holds the 
armor class in hex. If the armor class is negative, Byte 134 
($86) = FF and Byte 135 (87) = FF - armor class +1. 



Armor class 
3 
2 
1 

-1 
-2 
-3 



Bvte 134 ($861 
03 
02 
01 
00 
FF 
FE 
FD 

Gold 



Bvte 135 ($87) 
00 
00 
00 
00 
FF 
FF 
FF 



Gold is stored in a modified "256 counter". The first byte 
counts until it reaches 255 ($FF). When another gold piece 
is added, this byte goes to zero and the byte to its right goes 
to one. Then the first byte starts counting again. This 
continues up to 9999 gp which is stored as OF 27. 10 000 gp 
is stored as 00 00 01 . As more gold is added, one number is 
added to the third byte every time the first two bytes reach 
OF 27. The third byte goes to FF. 

OF 27 FF =2 559 999 gp 
00 00 00 01 = 2 560 000 gp 

Experience 

Experience points are stored in a modified "256 counter" 
like the gold. 

Marks 

Marks are stored in a modified "256 counter" hke gold 
and experience points. 

Swim Counter 

The swim counter counts how many times your character 
wades in a pool. Your swim stat goes up one for every nine 
wades. 

That's what I've found out so far. I hope it is useful to 
some of your readers. 

Items 

Each item carried (max 8) is stored in two bytes separated 
by $00. The first byte is the item code and the second is the 
item status. 



Item status codes 

00 = unidentified 

02 = identified 

03 = equipped 
07 = cursed 

OB = armor equipped 



Table of item codes 



Code Item 

01 Torch 

02 Lantern 

03 Rubber Duck 

04 Dagger 

05 Staff 

06 Short Sword 

07 Long Sword 

08 Mace 

09 Battle Axe 
OA Pike 

OB War Hammer 
OC Holy Basher 
OD Long Bow 
OE Thieves' Bow 
OF Robes 

10 Leather Armor 

11 Chain Mail 

12 Scale Mail 

13 Plate Mail 

14 Target Shield 

15 Heater Shield 

16 Leather Sallet 

17 Leather Gloves 

18 Short Sword +1 

19 Long Sword +1 
1A Black Blade 
IB Katana 

1C Battle Axe +1 
1 D Morningstar 
1 E Runed Flail 
IF Halberd 

20 Lt. Crossbow 

21 Leather +1 

22 Chain Mail +1 

23 Scale Mail +1 

24 Plate Mail +1 

25 Silver Mail 

26 Target +1 

27 Heater +1 

28 Crested Shield 

29 Brass Sallet 
2A Iron Gloves 
2B Bracers 

2C Long Sword +2 
2D Robin Sword 
2E Sword of Fire 
2F Master Katana 



Code Item 

31 Battle axe +2 

32 Axe of Death 

33 Saaed Basher 

34 Faust Halberd 

35 Silver Hammer 

36 Mage's Yew Bow 

37 Hv. Crossbow 

38 Leather +2 

39 Chain Mail +2 
3A Scale Mail +2 
3B Plate Mail +2 
3C Scarlet Robes 
3D Emeraki robes 
3E Heater +2 
3F Bacinet 

40 Cone of Fire 

41 Silver Gloves 

42 Bracers +1 

43 Long Sword +3 

44 Plate Mail +3 

45 ShieW Pro Magi 

46 Jeweled Armet 

47 Wizard's Cap 

48 Gloves of Myrdall 

49 Cloak of Capricorn 
4A Sylvan Bow 
4B Muramasa Katana 
4C Odin Sword 
4D Gold Plate +5 
4E Ring of Froze 
4F Ring of Skulls 

50 RingofMadi 

51 Ring of Jade 

52 Ring of Solitude 

53 Ankh of Wonder 

54 Ankh of Power 

55 Ankh of Life 

56 Ankh of Intellect 

57 Ankh of Sanctity 

58 Ankh of Youth 

59 Staff of Summoning 
5A Staff of Death 

5B SctoII of Katino 
5C Scroll of Stoning 
5D Scroll of Fire 
5E Scroll of Conjuring 
5F Potion of Dios 



Code Item 

61 Potion of Latumofis 

62 Potion of DiaIko 

63 Potion of Wounding 

64 Potion of Madi 

65 King of Diamonds 

66 Queen of Hearts 

67 Jack of Spades 

68 Ace of Clubs 

69 MunkeWand 
6A Lightning Rod 
6B Lark in a Cage 
6C Staff of Water 
6D Staff of Fire 
6EStaHofAir 
6F Staff of Earth 

70 Potion of Demon Out 

71 Gold Medallion 

72 Ice Key 

73 Ticket Stubs 

74 Tickets 

75 Skeleton Key 

76 Pocket Watch 

77 Battery 

78 Petrified Demon 

79 Gold Key 
7A Blue Candle 
7B Jeweled Scepter 
7C Potion of Spirit Away 
7D Hacksaw 
7E Bottle of Rum 
7F Silver Key 

80 Bag of Tokens 

81 Brass Key 

82 Orb of Uygamyn 

83 Heart of Abriel 

84 Holy Talisman 

85 Amulet of Rainbows 

86 Amulet of Screens 

87 Amulet of Flames 



Robin Lockslev 



MO 



Playing Tip for... 



Dungeon Master 
FTL 



The following information provided in the charts will 
help those who are starting this game and find it a real 
challenge. Good Luck. 

Dungeon Master Data 



Bolt Blade 


Sword 


Lightning (limited) 


Calista 


Crowm 


? 


Crown of Nera 


Crown 


Wisdom plus 10 points 


DeHa 


Sword 


Mana plus 1 point 


Dragon Spit 


Sceptre 


Mana plus 7 points 


Eye of Time 


Ring 


Freeze Life (limited) 


Firestaff 


Staff 


Fireshield 


Flame Bane 


Vest 


Anti-fire plus 12 points 


Flamitt 


Glove 


Fireballs 


Fury 


Sword 


Fireshield 


lllumulet 


Necklace 


Produces light when worn 


Inquisitor 


Sword 


Mana plus 2 points 


Jewel Symal 


Necklace 


Anti-magic plus 1 5 points 


Lock Picks 


? 


? 


Mace of Order 


Mace 


Increases load 4 kgs. 


Moonstone 


Necklace 


Mana plus 3 points 


Pendant Feral 


Necklace 


Wizard levels increased 


PowerTowers (Kid's game) 


Leg Plates 


Strength + 10 points- Load 
+ 8 Kgs. 


Rope 


Rope Increases Ninja levels (quickly) 


Sceptre of Lyf 


Sceptre 


Mana plus 5 points 


Snake Staff 


Staff 


Mana plus 8 points 


Staff 


Staff 


Mana plus 2 points 


Staff of Manar 


Staff 


Mana plus 10 points 


Storm Ring 


Ring 


Lightning (limited) 


The Conduit (Kid's game) 


Staff 


Mana plus 16 points 


The Hellion 


Necklace 


? 


Vorpal blade 


Sword 


Manaplus 4 points and Wiz- 
ard levels 



Yew staff 



Bash 

Berzerk 

Bk>ck 

Chop 

Cleave 

Jab 

Melee 

Parry 

Slash 

Stun 

Swing 

Thrust 

War Cry 

Climb 

Hit 

Kck 

Punch 

Shoot 

Stab 

Throw 

Blow Horn 

Brandish 

Disrupt 

Softkey for... 



Staff 
Dungeon Skills 



Mana plus 4 points 



Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Fighter 

Ninja 

Ninja 

Ninja 

Ninja 

Ninja 

Ninja 

Ninja 

Priest 

Priest 

Wizard 



ShiekJ 



Builds this level very quickly 
ShiekJ 



Opponent will back away 
Works well against flying enemies 
Vorpal Blade 



Dungeon Master 
FTL 

Requirements: 

Apple Ilgs 

Copy II Plus V. 9.1 

My thanks to Jim Ross. 1 love Dungeon Master but have 
been frustrated by the complex and novel arrangement of 
codes. I would like to add to what he has provided by 
supplying some additional information. First I have dis- 
covered two versions of Dungeon Master. They are 2.0 and 
2.1.1 also found that the byte locations provided by Jim were 
not the same for my disk even though 1 believe that he was 
working with v 2.0. 



Eli QM Eiam 

104 110 18 

104 114 38 



For version 2.0 

I2 
38 
18 

For version 2.1 



M E^ Essm. I2 

0E6 110 18 38 

0E6 114 38 18 

PS. © If anyone can find the LOCK PICKS in the game 
let me know. They are located on the program disk at: 
v2.0 Block 558 Track 41 Sector 00 Side 2 
v2.1 Block 53A Track 3F Sector 03 Side 2 



Charles R. Haight 



WA 



Editorial Notes 

USPS and mail forwarding 

Once or twice each month, I receive a call or letter stating 
"I have not received my issues." Further conversation/ 
reading reveals that a change of address has occured. 
Somehow they neglected to let Computist know. Hey, I 
understand! Moving is a busy, confusing and, all to often, 
traumatic experience. Change of address notices aren't 
always very high on the list of things to do, although they 
should be. (And there'salways the possibility that you don't 
want to let people know where you've gone.) 

For your information and to clear up why I always ask for 
postage costs in these instances, let me explain a little about 
how the U.S. Postal Service (USPS) handles your mail. 
Providing that you have let them know where you are going, 
the USPS will do the following, automatically: 

1st Class mail is forwarded for one (1) year after which 
it is returned to sender. 2nd Class mail is forwarded for tvvo 
(2) months. 3rd Class mail is thrown away. 4th Class mail, 
provided it looks valuable, is returned to sender. 

If you paid $24 for 8 issues then you have a regular 
subscription. Regular subscriptions are sent by 3rd Class 
mail. If you moved and didn't inform Computist, then your 
issues are decomposing in some landfill. That's a waste of 
money. 

In order to have your 3rd Class mail forwarded, you must 
ask for and sign a form that states that you want your 3rd 
Class mail forwarded and that you guarantee to pay any 
forwarding postage. If you do not ask for and sign this 
form, your Computist issues are thrown away along with 
any other 3rd Class mail. And when you call me and ask for 
more issues, the least that I will ask for is the 1st Class 
postage to mail them to you. If there are more than one or two 
issues, I will charge you the back issue rate. 

Since most junk mail is sent by 3rd Class mail, you may 
not want to pay the postage to have it forwarded to your new 
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address. Thesolutionissimple.letComputist 
know when you move and I will send your 
issues to the correct address. Please, F m not 
a mean person and it bothers me to take a 
hard line. Let me know when you move, it 
will save us both a lot of headaches. 

While we're on the subject of mail, I've 
got a couple of other comments. If you are 
changing from a regular sub ($24) to a 1st 
Class sub ($34), you can send $ 1 .25 for each 
of the remaining issues of your regular sub 
and I will upgrade those issues. That way 
you start getting your issues by 1st Class 
mail, right away. 

Also, if you're late renewing and you 
know that you missed an issue, send an extra 
$ 1 .25 for postage and I will back date your 
renewal and send you the missed issue by 
1st Class mail. 

Charge It! 

I receive a handful of calls each month 
that ask if we take credit cards. Seems they 
didn't notice that there is a place on the front 
cover subscription form for a charge card 
number and signature. The answer is yes, we 
take VISA and Master Card. It makes it 
easier to renew. So if writing a check and 
addressing an envelope is to much like work, 
just give us a call and charge it! 

IRS? 

Here' s the latest update on the Computist 
Chapter 1 1 action. Due to a clerical error one 
of the creditors wasn't given sufficient no- 
tice, so the Hnal decision on acceptance or 
rejection of our plan was delayed (again) 
untilJanuary 10, 1991. 

The IRS is insisting that we change the 
plan to allow them to charge us penalties and 
interest despite the laws that say a chapter 1 1 
estate doesn't pay interest The Computist 
lawyer says that the IRS almost always does 
this because they figure that paying them 
(the IRS) is cheaper than the legal fees to 
fight them. Also, there's some question as to 
whether allowing the IRS to receive interest 
might also allow other creditws to sue for 
interest and penalties. Like all legal actions, 
it's a bucket of worms that us mortals will 
never really understand. The lawyer say's 
that paying the IRS in full will simplify 
things tremendously so I say we go for it. 

If you aren't on a limited budget, send a 
donation to the IRS Fund. Let's pay them off 
so we can say good riddance and get on with 
publishing the next issue! Amen. 

Non-Subscriber? 

If you are calling for information or help, 
be sure that you tell me that you are not a 
subscriber. (It won't make any difference in 
the quality of assistance, I try to help everyone 
who asks.) When talking on the phone, I 
don't write down the full address that you 
give me. I only note the name and state. I 
figure that I can get the full address from the 
computer. This causes problems if you are 
not a subscriber and therefore not listed in 
the database. I have several letters sitting in 
my out-box thatdon'thaveany addresses on 
them. If you called and asked for informa- 
tion and you didn't receive a reply, maybe 
you should call again and make sure I get 
your address. 

Hardware? 

Yea, I ' m still hoping to get you interested 
in some kind of hardware project I made the 
"Instant On" battery backed SRAM card. 
It's a lot of fun and really convenient. But 
now that I've had some time to play with it 
I've thought of some changes that I want 
First there are 12 - 32K SRAM chips on the 
plug-in board. This comes to 384K of 
memory. It's not enough! Prograins stored 
on the card are available instantly, so you 
start putting more of them on the card until 
you suddenly run out of space. Then you 
have to pick and choose which ones you 
need the most. But the worst thing is that you 
get used to the instant load programs and it 
seems to take forever when you have to get 
something from a floppy disk. 

The price of 32K SRAM chips is down to 
$5 each. I've decided that it would be better 



to design a card(s) that fits into a old floppy 
disk case. That would allow me to put more 
32K chips on the board(s). I figure around 
32 chips (1Mbyte of SRAM) should keep 
me satisfied for a while. That's only $160 
for the SRAM chips. What do you think? 

Apple n Supercharger 

I'm running out of room here too but I 
wanted to say a few more words about the 
Option card. (One of our volunteers calles it 
the IIGTS card which translates as "II Good 
To Stop.) The circuit design is completed 
(on paper) and has been tested using an 
electronic CAD program (DesignWorks 
from Capilano Computing) with the clock 
set to 4Mhz . I think that the best way to make 
the actual board would be to make a plug-in 
card for slot 7 with three horizontal con- 
nectors so that 3 other boards could be 
plugged into this card. Two of these addi- 
tional cards would be the CPU card and a 
memory card. The slot 7 card would have 
interface circuitry to talk to the Apple. 

The reason for the multi-card design is to 
allow easy (cheap) upgrades to faster CPUs 
or larger RAM cards. The estimated cost of 
the project is $250-300. What do you think? 

The End of Year Book 
(loose-leaf, 3-hole punched) 

Hey! I'm almost thru with the formats 
and paging for the 8.5" x 11", laser printed 
book. I'll be working on it during Christmas 
vacation. If your tabloid issues are getting as 
tattered and yellowed as mine then you 
know why I'm in a hurry to get the book 
done. Look for an announcement (hopeful- 
ly) in issue #78 or #79. 

IBM RDEX IBM RDEX 



Marc Batchelor 
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IBM Softkey for... 
Indianapolis 500 "The Simulation" 

Electronic Arts 

Requirements: 

Debug 

Indianapolis 500 Original Disk 

The protection used on this program is 
really a "manual" protection. It is however, 
very good. The program loads a digitized 
graphic that matches 30 or so in the manual, 
and asks a question based on the caption 
underneath. It is a 'cute' implementation of 
a "manual" protection, but a pain in the tush 
each time you load the program. 

The first thing I tried to do is to search all 
the files for one of the questions asked. This 
led nowhere. The text (1 assume) is encrypt- 
ed on the disk. The next thing I did was have 
a look at the loading program INDY.EXE. 
The protection is located in the first 64K 
bank of the program . To locate it, I searched 
for interrupt 2 1 , function 6 (direct console 1/ 
0), parameter FF (input request). I found 
only one in the fu-st 64K bank. After playing 
around with this routine, I found that I could 
make it ignore the results of the input with a 
few changes. But, I wanted to disable the 
call all together. 

Going a UtUe further, I discovered a CALL 
to this location. After NOPing the CALL, I 
executed the program. The program loaded 
the digitized graphic, displayed it briefly, 
and then cleared the screen to the actual 
program. I decided that I wanted to avoid the 
loading of the graphic as well, so I directed 
my Debug session into a file. That is, DE- 
BUG file name > HLE.DIS [CR] UlOO 
FFFF [CR] Q[CR]. (Note: YouMUSThave 
a large hard drive to accomplish this feat.) I 
ended up locating a CALL BE9E which 
called the location that I found (after loading 
the graphic). I NOP'ed the call, and had a 
disk that worked fine without ever loading 
or displaying the digitized graphic and did 
not ask the player for any information. 

Step-by-step 

1. COPY INDY.EXE OLDINDY.EXE 

2. RENAME INDY.EXE INDY.TMP 



DEBUG INDY.TMP 

S100 FFFF E8 CC 00 E8 B9 8C Should respond: 
XXXX.YYYY 

EYYYY 90 90 90 replace YYYY with previous re- 
sponse 

W write the changes 

3. RENAME INDY.TMP INDY.EXE 
You are done! 



S.D.R. 



IBM Softkey for... 

Ultima V 

Origin Systems 

My hat goes off to Origin System s for not 
only creating a great adventure in Ultima V, 
but also splicing in an extra bonus, for peo- 
ple like me, in the form of copy-protection. 
Although I despise copy-protection I like to 
unravel its mystery if I can. I also learn from 
the experience which is good. Undoubtedly 
Origin could have made a full proof copy- 
protection but they choose not to. Again 
thanks to Origin for the double adventure. 

1. Copy ULTIMA.EXE from the original 
program disk to a blank formatted disk. 
Make sure you have a path to DEBUG or 
copy DEBUG to the formatted disk. Put 
the original Ultima program disk away, 
you won't need it again. 

2. From the A:> prompt type: 
ren ultima.exe ultima.xex 
debug 

N ultlma.xex 

L 

e8b65 

853535 

eSbaa 

35 3535 

e8c64 

1d87a6 06bda1 1d88a206bfa1 

e8c70 

1da5ad06b9a1 1d9ebe06bba1 

e8c7c 

28bbbda61ca0a53535 3535 

w 

q 

ren ultinia.xex ultima.exe 

Your ULTIMA.EXE will now be unpro- 
tected. You can put ULTIMA.EXE on your 
hard drive or on a copy of the original 
program disk. When you run the program 
you will not be asked to place the original 
disk in drive A: 



Mr. Magic 
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IBM Softkey For... 

IDIR.UNP 

Bourbaki 

IDIR is a solid hard disk "manager" 
program from Bourbaki, Inc. and licensed to 
Basic Time, etc. to be included with their 
hard disk units. The copy I received with my 
unit was "protected" and only ran on the 
Basic Time hard disk. The following patch 
will free the software for use on all hard 
disks. 

Copy 1DIR.COM to a diskette or the 
hard disk. Make sure you have a copy of 
DEBUG on the same volume. I assume you 
know how to use DEBUG. 
DEBUG1DIR.COM 
U3D53 

Confirm that the line in part reads... 
"3d53 . . . CMP AL, [ . . . ] " 

If yes, this patch will work. 
A3D53 

3D53 XORAL,AL 

3D55 NOP 

3D56 NOP 

3D57 
W 
Q 

That'sit IDIR should now work on all of 
your equipment. 

By the way, at $99.00 this is a pretty 
good program—don't rip it off. Unprotect 
it if you have other disks to use it with. 



NOP fNo Obtmstve Protection 

IBM Softkey for... 

Microstation v3.0D 



I'm sure some of you, like I do, have 
problems with those parallel port protection 
keys that come with some software. When 
you have 3 or 4 of them attached to the back 
of your computer, you have to have 8-10 
inches (!) of clearance for the back of your 
machine. And they tend to suffer great harm 
when attached to a laptop or portable. 

I like what Intergraph/Bentley Systems 
did in making Microstation run as a demo 
version if the key is not attached. However, 
while you don't lose your work, the abrupt 
program exit every 10 minutes or so is kinda 
annoying. 

So I offer a better solution. If this patch 
works, MicroStation will run continuously 
without the key. If not well, sorry to get 
your hopes up. 

I recommend you do this on a copy of 
your MGDS .EXE file so if something screws 
up you won't have to re-install Microsta- 
tion. 

copy mgds.exe *.old make a backup just in case 
ren mgds.exe x rename file for DEBUG 

debug x DEBUG loads file 

E 5BC9 EB patch file 

E9BA2EB 
E B127 EB 
R Display registers 

Look at the entry CS=xxxx, where xxxx 
is some hexadecimal number. Add 3(XX) hex 
to it to get another hex number yyyy. (ie. If 
xxxx=12A9, then yyyy=42A9.) 
Eyyyy:3C88B8 0445 89 46FCEB use correct 

yyyy value 
W mmmmm bytes written write file 

Q quit DEBUG 

ten X mgds.exe restore original name 

Done! Now run Microstation, and hope 
all goes well. Good luck. 

UNK 

IBM Softkey for... 
Where in Time is Carmen Sandiego 

Broderbund 

This program checks for the original key 
disk each time you are promoted in the 
game. 

I found another softkey (CARMNTME 
.ZIP) which did not work at all. If fact it 
made it so you can not even get into the 
program! 

Here'smine. You can patch the file either 
with a hex editor, or with debug. 

Using a hex editor 

Searchfor02El 07C3FA55andchange 
the 02 to 12. 

Using debug 

ren carmen.exe car 

debug car 

SOOOOFFFF02E107C3FA55 

xxxx:yyyy note value of yyyy 

e yyyy type e, then value of yyyy above 

xxxx:yyyy 02.12 

w 

q 

ren car carmen.exe 

That's it. And a lot easier then the other 
patch that didn't work! Although this patch 
only changes one byte, it was difficult to 
come up with. They used a far call which 
was hard to follow, and could not be nop'ed 
out Good Luck. 
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How to place an UnClassifled Ad 

Send a typed sample copy with appropriate instnictioiis. (If 
possible, send text on a 5.25" Apple format disk.) Use up to 40 
char^ters per line, we will adjust word wrap. 

Special Graphics Instructions: The &st three words of &e 
first line are printed in bold for free. If you want other words 
bolded, use 5 characters less per line. Use 1 characters less per line 
if you have a lot of uppercase bold letters. Bold letters are wider 
than normal. If the typed copy does not show bold, circle the words 
you want bolded and, an Ihe side, write BOLD. If you want a line 
centered, write CENTER next to that line. There is no charge for 
centering any line. 

You must check your ad for errors, the first time it runs . Errors 
on our part will be corrected, then, for free. Errors or changes on 
your part will be charged a $5 processing fee. 



•kirk-k New Rates (per line) kirikk 

Computist club member „ ..,.., 

All others 

The minimum order Is $g- 



...250 
...350 



• Our liability for errors or omissions is limited to the cost of the ad. 

• We reserve the right to refuse any ad. 

• Washington state residents add 7.8% sales tax. 

• Send a check or money order (funds drawn on US bank only) for 
the entire amount to: 

COMPUTIST unCLASSIFIEDS 

33821 East Orville Road 

Eatonville, WA 98328 



TRADE YOUR APPLE SOFTWARE 

Send your list of programs to trade. I have over 120 
originals to trade. 

Byron Blystone 

PO Box 1313 

Snohomish, WA 98290 



Software — Books — Magazines 

We buy & sell out-of-print & hard-to-find Apple 11 
origin^s, old and new. Send $l,for catalog. 

Frank Polosky 

PO Box 9542 

Pgh, PA 15223 



Wanted Apple lie Software 

Especially Wargames and science fiction. Also, what 
hardware do you have? Sell: 

Epson APL board (no docs) $12 

SpeedDemon Accellerator card (3.5Mhz) $60 

Apple He 80 column card (only) .$10 

Apple He 80 column card C'/64K) $20 

Dumpling-GX printer card (no docs) .$12 

Apparate PROM blasting System $25 

Apple 11+ motherboard (works OK) $60 

Grappler clone printer card .........$20 

I also have a few Apple One items, send SASE for 
more info. 

Joe Torzewski 

51625 Chestnut Road 

Granger IN 46530 



$10 Ten Buck Sale $10 

All Software Only $ 10 Each 

Black Cauldron — lie 

Copy 11 Plus v8.3 (disk only) — lie 

Curse of the Azure Bonds — He 

Destroyer — lie 

F-15 Strike Eagle — lie 

Into the Eagle's Nest — lie 

Karate Champ — He 

Marble Madness — He 

Might & Magic — He 

Print Shop — He 

Russia: The Great War in the East — He 

Softdisk Sampler — llgs 

Send Check/Money Order to: 

Alan T. Zak 
9724 N.W. 59th Place 
Gainesville, FL 32606 



RENT or BUY IIos SOFTWARE 

• Money Back Guarantee 

• Catalog contains over 200 titles 

• Rent for 15% - 20% of list price 

• Prices comparable with mail order 

' Rental fee discounted from purchase price 

• $15 Lifetime Membership Fee 

GSoft 

7350 Ulmerton Road - Suite 924 

Largo, Florida 34641 

(813) 536-4352 



RDEX Contributors: 
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67 

TheCPR Agent 5 ^ 

Marc Batchelor 8, 22 ^ 

Roland Boucher...... 11 gg 

Alan Chaney... 9 68 

Dr Crack 12 62 

Rick Davis 14 67 

Edison 4 g^ 

Edward Eastman 17 gj 

Gary WiUs 18 68 

Kim Griffith 18 75 

Suzanne R. Harvey 20 ^^ 

E.N. Hondrick 11 ^^ 

Steve Kalynuik 10 69 

J. L. Walters 14 73 

Ed Lee 4 66 

Robin Locksley 21 ^^ 

63 

Mr. Magic ...22 ^ 

Momma 13 57 

Rod O'Brien 13 86 

NOP (No Obtrusive Protection. .....22 61 

S.D R. 22 65 

George Sabeh 16 g^ 

Ephraim Santiago 5 g? 

UNK 22 75 

69 

Most Wanted i 

63 

65 Airheart Broderbund 72 

63 Alcon Taito 71 

74 MgBbrs. Shop Scholastic 75 

63 Alien Mind PBl Software ^ 

73 American History Explorer Series Mindscape 75 

75 Anchomian Virginia Reel 72 

74 Animals of the Past Focus Media g? 

72 Ankh „ Datemost 72 

73 Ant Farm Suntairst 75 

67 Aquatron Sien-a gg 

69 Axis Assassin ? 65 

63 Bad Street Brawler Mindscs^ 74 

73 Bank Street Banner's Filer Sunburst g5 

73 Bank Street S*od RIer Sunburst ^ 

63 B^ond Zork tnfocom 73 

K Bilestoad Oatamost 74 

69 Blue Powder - Grey Smoke Grade g7 

74 Birds, Trees & Fkswers Focus Media ^ 

m Bor<ter Zone Infecom ^ 

65 Borg ; Sinus gg 

67 Bouncing Kamungas Penguin ga 

66 Boxing ? 68 

65 Bureaucracy Infocom 73 

67 C'est Li Vie Adventure International 33 

69 Caverns of Callisto Origin ^ 

69 Checter Odesta 66 

69 Chess 7.0 Odesta 74 

69 Chuck Yeager'sAdv Fit Trainer Electronic Arts 66 

75 Clue Master t)eteciive taisure Genius 53 

68 Comics Accolade $8 

63 CiKmic Relief., Oatasot gg 

65 Crime S Punishment Imagic $7 

69 Crossword Magic v4.0 ? 67 

69 Cybernation Nexa Corp. 74 

74 Oedmal Dungeon Unicom 75 

COMPU"nST«77j 



Decisions Decisions: Colonization v1 .0 Tom Snyder Productions 67 

Delta Squadron Nexa Corp. B 

Desecration Mind Games 67 

Disk Optimizer System Nibble Notch 68 

Dondra Spectrum Holotyte 62 

Dragon Eye. Ef^x 63 

Dueling Digits Broderbund 68 

D&O-Master Assistant ¥ol2 ; SSI 67 

DROL Broderbund 63 

Epoch Sirius 67 

Exploring Tables & Graphs Level 2 (SU) Weekly Reader 67 

Evislution ..Sydney 63 

Falcons Piccadilly 69 

Factastics Trivia Oaystar 75 

Final Frontier ....Softsmith 63 

Fisher's Cove „....„ , Tom Snyder Producttons 62 

Fit Wars Sirius 67 

Fracflon Action Unicorn 74 

Gemstone Healer , SS! 68 

GeomefricSupposer(thej Sunburst 63 

GEOS Berkley Softwori^s 63 

Gatoic Gladiators SSI 67 

Gladiator Taito 62 

Goodell Diamond Caper Tom Snyder Productions 67 

Gorgon Sirius 62 

GradeBuster 1 2 3 Grade Buster 67 

Gutenbeig Sr. Micromation LTD. 67 

Halls of Montezuma , Electronic Arts 63 

Hard Hat Mack ? 67 

HighOrtxt , Softsmith 65 

Horizon V ...Softsmith 61 

Hunt for Red October GS Datasoft 74 

ImpossiWe Mission.... Ef^x 68 

Indoor Spods Mindscape 68 

Infocomics Infocom 69 

Jane ? 72 

Joker Poker Mindscape 74 

Kabul Spy Sirius ^ 

Keyboarding Klass .,. Mastery Devetopement 63 

King's Boun^ New Worid Computing/Broderbund 74 

Kingdom of Facts Santa BarbarafThunder Mountein 74 

Kobayashi Alternative (The) Simon & Schuster 63 

Lane Mastodon Infocom 68 

Lancaster SVS 69 

Laser Force (llgs) Britannica 68 

LA. Land Monopoly Softsmith 72 

Legacy of the Ancients Electronic Arts 68 

Lost Tomb Dalasoft 73 

Mammals, Repies & Amphibians Focus Media 73 

Manhunter New York llgs Sierra On Line 68 

Mavis Beacon Teaches Typing (gs) Software Toolworte 66 

McGraw-Hill Probtem-SoMng Level 5 and 6 Tom Snyder 61 

Micro-Typewriter V3.1/4.0 S.E. Warner 67 

Microwave Cavalier 63 

Might and Magic II Activision 63 

Mind Caste 1 MCE Inc. 68 

Minotaur Sirius 65 

Modem MGR MGR Software 67 

Mr. Pixel's Cartoon Kit Mindscape/Thunder Mountain 

Mysteiy of Itetel Victoria > Tom Snyder Productions 

Natksnal Inspirer Tom Snyder Productions re 

Neptune Softsmith 72 

Observatory (The) Mindscape/Lightepeed Software 68 

Ocean Ufe .". , Focus Media 61 

Odin Odessta 63 

Operation Wolf Taito 72 

Pensate Datasoft/Softdisk 72 

Phantasie II ..; .^ SSI 72 

Phantoms 5.. ;........ Smus , 

Pig Pen , Datamost 

Plants 8 Animals of fce Desert : Focus Media 

Prince of Persia (5.25'^ ..Broderbund 

Readsrs Data Exchange 



Project: Space Station Avantage 

Promethean Prophecy (The) Simon & Schuster 

Pulsar II Sirius 

Pure Stat Basketball ? 

Quadratic Equations II Olympus Educational Software 

Questronll Electronic Arte 

Rails West , SSI 

Rear Gtiard .Adventure Intwnational 

Renegade Taito 

Rescue Raiders Sir Tech 

Rings of Saturn; Level 10 ? 

Rocket Ffenger (ligs) Cinemaware 

Roundabout .,.. Oatamost 

RusskiDuc* Softsmith 

S.D.L(llgs) Cinemaware 

Sea Stacker.. .~ Broderbund 

Serpentine Broderbund 

Seven Cities of Gold , Electronic Arts 

Skeletal System Brainbank 

Sky Shark Taito 

Sound Song & Vision Advanced Software 

Space Ark Datamost 

Spare Change Broderbund 

Spectre Datamost 

Speedy Spides Readers Digest 

StarCaiiser Sirius 

Star Maze Sir Tech 

StickyBear Math: Add & SubtrK* Optimum Resources 

Succession Piccadilly 

Supereter to Hockey Mindscape 

Superstar Indoor Sports Mindscape 

Surveys Unlimited Mindscape 

Talking Tex! Writer GS Scholastic 

Tan^d Tales .....Origin Systems 

Tetris (lie) Spectrum ttolot^ 

Theatre Europe ; PBl 

The Other Side v2.0 Tom Snyder Productions 

Thunder Chopper ,...? 

Ticket to Washington O.C Blue Lion Software 

Time Explorers Gameco 

Time Liner vl.1 Tc» Snyder Productions 

Tomahawk Electronic Arts 

Tomahawk (llgs) Datasot 

Track Atteick Broderbund 

Triad Thunder Mountain 

Triango (tigs) California Dreams 

Trinity Infocom 

Unicorn 5.25" software Unicorn 

Vincent's Museum Tom Snyder Productions 

Volcanoes v1.8 Earttiware Com p. Services 

War in the Middle Earth Melbourne 

Wasteland Electronk; Arts 

Wayout ...Sirius 

Wings of Fury Brodertsund 

Wizardry :Retum of Werda Sir-Tech. 

Word Atte(*Plus (llgs) Davidson 

Worics (the) [ First Star Software 

Zenith Softsmith 

IBM Most Wanted 

Empire Intereil 

GBA Championship Football .Electronic Arts 

Graffiti ..: George Best PWIIii» teademy 

Gunship Microprose. 

Heros of the Lance SSI 

Kings Quest III , , ,., Sierra 

Operation Wolf ;..: ........1.....; :Taito 

Radio Baseball .....'..: E!«:trbnic Arts 



23 



73 The Product Monitor - Dragon Wars - 
Fast Frames, Updates, etc. - 2088: Bargain 
Thrills - Dragon Wars Tavern Tales •Fea- 
tures, Notes and such: A note about Reading 
& Me •Autocopy Farm to copy Ultima V: 
•BBS News (RDEX entries) •BBS Notes 
(Questions and Answers) "Behind the scenes 
of a One Byte Patch •Blocks vs Tracks — 
ProDOS & DOS Converting from/to blocks 
& sectors 'Bug in Crystal Quest Mod (issue 
#71) •Cheap NMI? •Comments on Assem- 
bly Language Programming for Beginners 
•Comments: Copy II Plus 9.0 •Free Ad- 
venture Maps •MONRWTS A Read/Write 
disk routine 'Note on Bilestoad •Notes on 
Disk Muncher 'Notes on LaserForce 'Notes 
on War in Middle Earth 'Put Ancient Land 
of Ys on a Harddrive "Putting Shanghai on 
a hard disk •Quick and dirty ProDOS 16 
READ_BLOCK patch 'Rick's Hello •Run 
Paintwoiks Gold under GS/OS 5.0 -Senior 
PROM — NOT Available -Some notes on 
Copy II Plus v9 •Some notes on RISK 
(Leisure Games) •Ultima II Character Ed- 
iting •Ultima IV HELP •Using Copy II plus 
to make an APT 'Softkeys: Ancient Land of 
Ys •Arkanoid II: Revenge of Doh •Bad 
Dudes •Battle Chess 'Battle Chess GS 
'Bubble GhostGS'CharlieBrown's ABC's 
'Chem Lab 'Curse of the Azure Bonds (He) 
'Downhill Challenge 'Four-in-One Infocom 
Sampler 'GBA Championship Basketball 
'Geometry vl.O 'Grand Prix Circuit 'Great 
Western Shootout 'Heavy Barrel 'How the 
West was One + Three x Four 'Impossible 
Mission II 'Jack Nickalaus' Greatest 18 
Holes of Major Championship Golf 'King 
of Chicago 'Neuromancer 'Operation Frog 
'Planetfall 'Platoon 'Pool of Radiance (He) 
'Sokoban 'Stickybear Opposites GS 
'Stickybear Shapes GS 'Study Skills 'Test 
Drive II: The Duel 'Test Drive II: The Duel 
(GS) 'The Children's Writing and Publish- 
ing Center 'The Design Your Own Home 
Series -Architectural Design -Interior De- 
sign -Landscape Design 'Think Quick vl.2 
•Three Stooges •Tunnels of Armageddon 
•U.S.A. Geograph vl .0 •Ultima II (Original 
Version) 'Where in North Dakota is Carmen 
Sandiego 'World Geograph vl.l 'Bitkeys: 
'Dungeon Master 'Gradebusters 123 v3.35 
•Math Blaster Plus! v3.1 'Suike Fleet' Where 
in the USA is Carmen Sandiego 'APTs: 
A.E. 'Alien Ambush 'Alien Game -Apple 
Kong 'Apple Panic 'Battle Zone 'Beer Run 
'Bellhop 'Berserker 'Bolo 'Borg 'Bruce 
Lee 'Buck Rogers -Bug Attack 'Buzzard 
Bait 'Cannonball Blitz 'Canyon Climber 
-Captain Power -Caverns of Calisto 'Ceil- 
ing Zero 'Choplifter 'Color Planetoids 
'Congo 'Creepy Corridoors 'Crisis Moun- 
tain 'Crossfire -Crystal Castles -Cycled 



'Diamond Mine 'Dig 'Em 'Dig Dug 'Donkey 
Kong 'Dragon Wars 'Drelbs 'Drol 'Dung 
Beetles 'Electro Arena 'Eliminator 'Evolu- 
tion 'Falcons 'Falcons II 'Fire and Ice 'Free 
Fall 'Frogger 'Galaxian 'Genetic Drift 
'Gobbler -Gold Rush 'Halloween 'Hard Hat 
Mack 'Hellstorm 'Hellstrom 'Horizon V 
'Ice Demons 'Jawbreaker II 'Joust (Atari- 
soft) 'Jouster 'Jump Jet 'Jumpman 'Kameari 
'Labyrinth 'Mapple: 'Marauder 'Mars Cars 
'Microwave 'Milipeed 'Miner 2049er 
'Money Munchers 'Montezuma's Revenge 
•Mouskattack 'Mr Cool 'Mr. Robot and the 
Robot Factory 'Neptune 'Night Crawler 
'Nightmare Gallery 'Nomads 'Oils Well 
'Outpost -Phaser Fire -Pooyan 'Quadrant 
61 12 'Quest For Tires 'Raiders of the Lost 
Ring 'Randamn 'Raster Blaster 'Rearguard 
-Repton 'Ribbit 'Robotron: 2084 -Sammy 
Lightfoot 'Sea Dragon 'SeaFox 'Serpentine 
'Situation Critical: 'Snack Attack 'Snake 
Byte 'Snapper 'Sneakers -Snoogle 'Space 
Cadets 'Space Quarks 'Spy's Demise 'Star 
Maze 'Star Thief 'Star Trek 'Succesion 
'Super Puckman -Swashbuckler -Syzygy 
-Taxman -Teleport 'Thief 'Threshold 
•Thunderbombs 'Tubeway 'Tubeway II 
'Viper 'Wargle 'Warlock GS -Zany Golf 
GS 'Playing Tips: Bard's Tale I 'Dungeon 
Master 'Neuromancer 'Ultima III 'Ultima 
V 'Where in the World is Carmen SanDiego 
'Wizardry (Proving Grounds of the Mad 
Overlord) 'Wizardry 'Zork Zero 'IBM 
Playing Tips: Mean Streets 'Mech Warrior 
'Pool of Radiance 

72 Features, Notes and such: The Prod- 
uct Monitor 'A Bug in Prentice Hall Science 
Courseware 'A note on Stickybear encrypted 
sector 'An accelerated He & EDD 4 'Find- 
ing the licencee's name in GEOS 'A BUG in 
Teacher's Tool Kit Series 'A reader review 
of the Trac Card -An Explanation of Self- 
sync Bytes -Another reason why Cookbook 
Cracks might not work -BBS News 'Be- 
ginners Guide to"PACMAN" deprotection. 
'Bogus 18 sector disks? -Bug in Type! 
softkey -Bugs in Pool of Radiance 'Changing 
levels on Tetris (lie) -Cheats, Hints, and 
Tips for Neuromancer -Comments & pos- 
sible help to other readers 'Comments on 
IBM Ragging 'Converting Print Magic 
Graphics to Publish It! 'Copy Protecting 
Your Own Disks with ProDOS 'Determin- 
ing when individual files can be removed 
from a Protected Disk 'DOS 3.3P (for pro- 
tected) 'Enhancing DOS 3.3 'FIND.CAT 
Enhancement 'Half & quarter Tracks 'In- 
stalUng GS/OS on Sierra 3D Adventures 
'Lifting the Lid on COPYA 'Making Jack 
Nicklaus Greatest 18 Holes of Championship 
Golf play faster -Moving Destroyer GS 
(Epyx) to Hard Disk -Note on '84 & '85 



MECC disks 'Notes on programs published 
by Micrograms -Notes on Time Out and 
Appleworks 2. 1 'Notes on Ultima IV and V 
-Print in Color with Appleworks -Put Au- 
toduel on a 3.5" diskette -Reading From 
Protected ProDOS Disks -Removing the 
Manual Check from Pirates! GS -Running 
other programs from your Hard Disk -Super 
6.0 FastcopyA -Fun with Super 6.0 Fast- 
copy A 'Turn Dig Dug into a BRUNable File 
'Ultimapper V: a mapping program 'Soft- 
keys: Addition & Subtraction 'Aesop's 
Fables He 'Algebra 1 'Algebra 2 'Algebra 3 
'Alphabet 'An Introduction to General 
Chemistry 'APBA Major League Players 
Baseball 'Arkanoid 'Arkanoid ILThe Re- 
venge of DOH (GS) 'Balance 'Balance of 
Powerl990v.2.08'Biosolve'BubbleGhost 
(GS) 'Building memory Skills 'Calendar 
Crafter vl.2 'CBS's Pathwords 'Charlie 
Brown's 1,2,3's 'Chessmaster 2100 vl.l 
-Children's Writing & Publishing Center 
'Conquering Decimals * and /'Conquering 
Decimals + and -. 'Conquering Fractions; * 
and /. 'Conquering Fractions; + and -. 'Co- 
ordinate Math 'D.C.Heath/MB 'Dark Lord 
'DataEast Games 'Decimal Concepts 
'Decimal Discovery 'Decimals) 'Delta 
Drawing 3.33 'Designasauraus 'Dig Dug 
'Duel (gs) 'Early Games 'Eliminator 
'Equation Math 'Estimation 'Explora- 
Classic series 'Explora-Science Whales 
'Fraction Concepts 'Fraction Practice Un- 
limited 'Fraction Recognition 'Fractions 
•Freddy's Puzzling Adventures •Frogger 
•Galaxy Math Games •Galaxy Search 
•Garfield Companion •Garfield Trivia 
'Geomeuy (GS) 'Ghostbusters 'Gnarly Golf 
(GS) 'Gnee or Not Gnee 'Grammar Exam- 
iner 'Graphics Studio 'Guiness World 
Records 'Homeworker 'Houghton Mifflin 
Math Courseware -Ice Demons 'Ivitation to 
Math series 'Kid Niki 'King of Chicago 
•Kittens, Kids, and a Frog -L. A. Crackdown 
-Language Carnival -Magic Slate II -Magic 
Word -Master Match -Math And Me 'Math 
Blaster 'Math Blaster Plus 'Math for Ev- 
eryday Living 'Math in a Nutshell 'Math 
Masters 'Math Tutor (Percents 'Mathematics 
Skills 'Mavis Beacon Teaches Typing (He) 
-McGraw Hill Compucat Quizware -Mem- 
ory Castle -Meteor Multiplication -Mi- 
crozine #3 -Microzine #8 -Microzine #9 
-Microzine #10 -Microzine # 1 1 -Microzine 
#12 -Microzine #13 -Microzine #15 -Mi- 
crozine#16'Microzine#22 'Microzine #23 
'Microzines and Microzine Jr. 'Mixed 
Numbers 'Moptown Hotel 'Mr. and Mrs. 
Patatohead -Mr. Pixel's Programming Paint 
Set -Mystery Matter -Mystery Objects 
-Numbers -Opposite -Organic Chemistry 
'Pacman 'Peanuts Math Matcher 'Percent- 



ages 'Perplexing Puzzles -Pick the Num- 
bers 'Picture Perfect 'Pirates! GS -Pixel- 
werks •Platoon 'Police Quest 'Pool of Ra- 
diance 'Quest Strategy Checker 'Rainbow 
Painter 'Ratios & Propotions 'Read 'N Roll 
1.1 'Read-Write-Publish 'Reading Com- 
prehension 'Robomath 'Sailing Through 
Story Problems 'Scuffy and Friends 'Sen- 
sible Speller (ProDOS) 'Sierra Programs 
'Silicon Dreams 'SOKO-BAN 'Solving 
Quadratic Equations -Spelling Bee 'Spell- 
tronics 'Spy's Adventure in South America 
•Square Pairs •Star Trek •Stickers •Study 
for Success •Success With Typing •Super 
Print •Tales of Fantasy •Talking Stickybear 
Opposites •Talking Text Writer -Teasers by 
Tobbs -Test Drive H: The Duel (Ilgs) •Test 
Taking Made Easy •The Boars Store * -The 
Boars Tell Time 'The DuehTest Drive H 
•The Game Show •The Games: Winter 
Edition •The Wonderful World of Paws 
•Time Capsule •Times of Lore 'Townbuilder 
•Transylvania •VCR Companion •Voyage 
of the Mimi •What makes a Dinosaur sore 
•Where in the USA is Carmen SanDiego 
'Where in the World is Carmen SanDeigo? 
(GS) -Who, What, Where, When, Why 
•Whole Number Operations •WISCR In- 
telligence Test 'Wood Car Rally 'Word 
Attack Plus! Spanish 'World Geograph 
'World History Adventure 'Xenocide (GS) 
•Bitkeys: Borg -Great Western Shootout 
•Laser Force •Math Blaster Mystery •The 
Hunt for Red October -APTs: Anti Gravity 
•Autoduel •Bard's Tale II •Chrono Warrior 
-Commando -Demonic Decks -Neuro- 
mancer -Pool of Radiance -Tetris -The Bards 
Tale III •Track & Field -Victory Road 
•Xevious •Zany Golf -Playing Tips: Bard's 
Tale II -Bard's Tale III -Defender -Defender 
Of The Crown (IIGS) -Leisure Suit Larry 
-Moebius -Pool of Radiance -Print Shop 
Companion -Robocop -Tower of Myraglen 
•Wasteland -Who Framed Roger Rabbit 
-Wings Of Fury -IBM Softkeys: 688 Attack 
Sub -Battle Chess -Battle Hawks 1942 
•Chuck Yeager's Advanced Flight Simula- 
tor vl.O 'Shinobi -IBM Feature & Notes: 
Bug in APT for Zany Golf -Cracking on the 
IBMpc* 

and much more. . . 

For a complete back issue list, send a 650 
stamp to Computist. 
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Some disks apply to more than one issue and are 
shown as taller boxes. 
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Limited supply — first-come-first-serve basis. 
Out-of-print — only "Zeroxed" copies for sale. 
Issue 66 is laser printed on SV^ by 11 paper. 
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Back Issue Order Form 
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COMPUTIST back issues and 

library disks are frequently 

referenced in current issues. 

Back Issue and Library Disk Rates 



US. 


Canada & Mexico 


All others 


Back issues (1 - 9) 


$4.75 


$8.75 


Back issues (lO^-) 


$3.75 


$6.00 


Zox back issues 


$4.75 


$8.75 


Library disks (1-9) 


$5.50 


$7.50 


Library disks (10+) 


$4.00 


$6.00 



Due to the time and effort involved in making Zox 
copies, their price will remain at $4.75 each for US, 
Canada & Mexico and at $8.75 for all other Foreign. 

Shipping is included in all the prices shown. 

What's a library disk? 

A library disk is a 57^ inch floppy diskette that con- 
tains programs that would normally have to be typed in 
by the user. Documentation for each library disk can be 
found in the corresponding issue. 

'Library disks are available for all issues of 
COMPUTIST. 

For a complete back issue list, send a 65( stamp to 
Computist. 



Number of back i$sues. 



Number of Zox back issues. 



Number of library Disks. 



Washington state residents add 7.8% tax 
Total enclosed 



Name . 



City 



_Stt« . 



-Zip- 



CouQtiy 

VISA 

MC 



.Exp.. 



Signature _ 



_CP77 



• US funds drawn on US bank. • Most orders shipped within 5 working days, 
however please allow up to 4 weeks delivery for some orders. • Large orders are 
shipped UPS so please use a street address. • Offer good while supply lasts. 'Call 
(206) 832-3055 to use a credit card or send check/money order to: 

COMPUTIST 33821 E Orvllle Road Eatonville WA 98328 
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Readers Data Exchange 



COMPUTIST #77 



